Executive brief
Concrete CMS is a popular open-source content management system. A flaw in how Address fields are displayed in the dashboard allows attackers with basic user permissions to inject malicious scripts that execute in the browsers of administrators and other dashboard users. An attacker could steal session credentials or perform unauthorized actions on behalf of victims.
Technical details
The vulnerability is a stored XSS in the Address attribute's country-less text formatter due to missing HTML escaping. The root cause is that the Express association templates echo the association label mask without applying the h() escaping function. A non-required Address attribute that accepts a blank country field creates the unescaped code path. An authenticated user with permission to submit an Address attribute can inject arbitrary HTML and JavaScript; the payload executes in the dashboard when any user (including administrators) views the affected entry. The fix is available in Concrete CMS 9.5.3 and later.
Affected products
- Concrete CMS Concrete CMS below 9.5.3
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched: Fixed in version 9.5.3