Executive brief
Concrete CMS, a popular open-source content management system, contains a Server-Side Template Injection vulnerability in its theme customization feature. An attacker with theme customization permissions can inject malicious code that reads sensitive files (like database credentials and private keys) from the server and expose them in publicly served CSS cache files. This enables attackers to steal application secrets and potentially compromise the entire site infrastructure.
Technical details
The vulnerability is a Server-Side Template Injection (SSTI) flaw in the Theme Customizer component affecting Concrete CMS versions 9 through 9.5.2. Style values (color channels and other properties) submitted through the customizer are interpolated into server-compiled LESS source without sanitization of LESS syntax. An authenticated user with the Theme Customization permission can inject arbitrary LESS directives, including the @import (inline) directive, to read arbitrary files on the server and access internal network resources via PHP stream wrappers. The compiled CSS output, including any disclosed file contents, is written to the site's publicly accessible CSS cache, exposing sensitive data and enabling server-side request forgery attacks. No patch availability information is confirmed in the advisory.
Affected products
- Concrete CMS Concrete CMS 9 through 9.5.2
Timeline
- 2026-09-11: disclosed