Executive brief
Concrete CMS is a web content management system used to build and manage websites. Versions 9.0.0 through 9.5.2 contain a stored cross-site scripting vulnerability in the Groups dashboard. An authenticated user with permission to create group folders could inject malicious scripts into folder names that would execute in the browser of any administrator viewing the Groups page, potentially allowing theft of administrative sessions and tokens.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the group folder handling mechanism. The add and edit group-folder handlers accept user input for folder names without HTML sanitization, and the group search grid displays these names without output encoding, causing the Group dashboard to render untrusted markup as live JavaScript. An authenticated attacker with the "Add Group Folder" permission can craft a malicious payload as a folder name; when an administrator views the Groups dashboard, the payload executes in the administrator's session context. This enables session hijacking, token theft, and execution of any action available to the compromised administrator account. The fix requires input sanitization during folder creation and output encoding during display.
Affected products
- Concrete CMS Concrete CMS 9.0.0 to 9.5.2
Timeline
- 2026-09-15: disclosed