Executive brief
Concrete CMS, a popular content management system, is vulnerable to a security flaw where malicious scripts can be stored and executed in the browser of other users. An attacker with high-level administrative privileges can inject these scripts through the 'external-link' page name field. If successful, this could allow the attacker to perform actions on behalf of other administrators or access sensitive session information when they view the affected page.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in Concrete CMS versions 9.5.0 and earlier. The vulnerability is located in the 'cvName' parameter of external-link pages, where the 'updateCollectionAliasExternal' function fails to properly sanitize user input. An attacker with high privileges (PR:H) can inject malicious JavaScript into the page name, which is then stored in the database. The script executes in the context of any user (typically another administrator) who views the affected page in the CMS dashboard or sitemap. This issue is resolved in version 9.5.1.
Affected products
- Concrete CMS Concrete CMS <= 9.5.0
Timeline
- 2026-05-21: disclosed: NVD Published Date
- 2026-05-22: advisory: GitHub Advisory published
- 2026-05-22: patched: Version 9.5.1 released with fix