Executive brief
Concrete CMS is a popular content management system used to build and manage websites. An authenticated user with permission to edit board contents can inject malicious JavaScript code that persists in the database and executes when any visitor (including administrators) views the affected board. This can enable attackers to steal session credentials, perform unauthorized actions, or escalate privileges to administrator level.
Technical details
This is a Stored Cross-Site Scripting (XSS) vulnerability in the Board Custom Slot dialog's save_template endpoint. The vulnerability arises because the endpoint accepts user-supplied selectedTemplateOption[collection] data and persists it without server-side validation or sanitization, even though authorization checks are performed via canEditBoardContents(). The malicious JavaScript payload is stored in the description field of a summary object and executes in the context of any user viewing the board, since the default template renders the description field without output encoding. An attacker requires authenticated access with board editing permissions, but can then compromise any user viewing the affected board. Versions 9.0.0 through 9.5.2 are affected; versions below 9 do not include the Boards feature.
Affected products
- Concrete CMS Concrete CMS 9.0.0 to 9.5.2
Timeline
- 2026-09-11: disclosed