Executive brief
Concrete CMS is a web-based content management platform used to build and manage websites. Versions 9.0.0 to 9.5.2 contain a stored cross-site scripting vulnerability in the Page Container dashboard feature that allows a user with dashboard access to inject malicious script. When other administrators or editors view the affected dashboard, the injected script executes in their authenticated browser session, enabling attackers to steal session tokens and perform unauthorized administrative actions on the CMS.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in Concrete CMS versions 9.0.0 to 9.5.2. The vulnerability exists in the Page Container icon value handling: the dashboard accepts and stores an icon value from user input without validation against known container icons, and later a helper function concatenates this unvalidated value into the src attribute of an img tag without encoding attribute output. An attacker with delegated dashboard access to Page Containers can craft a malicious icon value (e.g., breaking out of the src attribute syntax) that executes script in the browser of any other editor or administrator viewing the Containers list or editor views. Attack preconditions include having delegated access to the Page Containers dashboard and requiring the target user to view the affected page. The payload executes in the authenticated session context, enabling session token theft and privilege escalation. Patches are available in Concrete CMS versions after 9.5.2.
Affected products
- Concrete CMS Concrete CMS 9.0.0 to 9.5.2
Timeline
- 2026-09-14: disclosed