Executive brief
Concrete CMS, a popular website content management system, allows administrators and editors to embed YouTube videos using a built-in block. A vulnerability in versions before 9.5.3 fails to properly validate width and height parameters for these YouTube embeds, allowing a user with block editing permissions to inject malicious code that executes when the page is viewed. This could enable an attacker to steal administrative credentials, modify website content, or compromise visitor accounts.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the YouTube block implementation. The vulnerable code applies only trim() to the stored width and height values and outputs them directly into iframe HTML attributes without proper escaping or integer casting. An attacker with edit_block permission can inject event handler attributes (e.g., onload=) that execute arbitrary JavaScript with the privileges of the victim user. If the victim is an administrator, the injected script executes with administrative privileges. The vulnerability requires network access and user interaction (page rendering), but no direct authentication is required for the payload to execute once stored.
Affected products
- Concrete CMS Concrete CMS before 9.5.3
Timeline
- 2026-09-14: disclosed