Executive brief
Concrete CMS, a popular open-source content management system, contains a vulnerability in its Gallery block feature that allows editors to inject malicious scripts into image captions. When visitors view a gallery image with a malicious caption in a lightbox, the injected script executes in their browser, potentially stealing credentials, session data, or performing unauthorized actions on the site.
Technical details
This is a stored DOM-based Cross-site Scripting (XSS) vulnerability in the Gallery block's caption field. The root cause is in the bundled Magnific Popup lightbox script (concrete/js/features/imagery/frontend.js), which decodes HTML attributes and then re-parses them as HTML via jQuery's .append() method instead of inserting them safely as plain text. An authenticated user with page editing permissions can inject a crafted caption containing JavaScript that will execute in the browser of any site visitor who opens that image's lightbox. The vulnerability requires the attacker to have edit permissions on a page containing a Gallery block and user interaction (opening the lightbox) to trigger execution.
Affected products
- Concrete CMS Concrete CMS 9.5.2 and below
Timeline
- 2026-09-15: disclosed