Executive brief
Concrete CMS is a web content management system used to build and manage websites. A flaw in versions before 9.5.3 allows editors to inject malicious scripts into form field labels, which then execute when administrators view the Dashboard Form Submissions report. An attacker with editor permissions could gain control of administrator browsers and perform actions on their behalf, including stealing session data or modifying site content.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Dashboard Form Submissions report functionality (concrete/single_pages/dashboard/reports/forms/legacy.php). The root cause is the failure to apply HTML entity encoding to user-defined Form block question labels before rendering them as column headers. An attacker with editor privileges can inject arbitrary HTML and JavaScript into form field labels; when an administrator accesses the submissions report for the affected form, the unencoded script executes in their browser context. This allows session hijacking, credential theft, or malicious actions performed as the administrator. The vulnerability has been patched in version 9.5.3.
Affected products
- Concrete CMS Concrete CMS before 9.5.3
Timeline
- 2026-09-15: disclosed