Executive brief
Concrete CMS, a popular open-source website content management system, contains a vulnerability in its Express form feature that allows attackers to inject malicious code into forms. An attacker can trick an authenticated administrator into unknowingly saving forged form data containing malicious JavaScript, which then executes persistently for any administrator viewing that entry, leading to account compromise or unauthorized actions.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Express entities forms dashboard controller, specifically in the save_control action. The root cause is the absence of anti-CSRF token validation, combined with lack of output encoding on Express form Text elements. An unauthenticated remote attacker can craft a forged cross-site request that, when submitted by a tricked authenticated administrator, writes attacker-controlled HTML/JavaScript to an existing Express form Text control. The injected markup executes without encoding in the browser context of any administrator subsequently viewing the affected entry. This requires user interaction (administrator must visit a malicious site and trigger the request) and affects administrators with form editing privileges. Concrete CMS 9.5.3 and later include the fix.
Affected products
- Concrete CMS Concrete CMS below 9.5.3
Timeline
- 2026-09-15: disclosed