Executive brief
Concrete CMS, a popular open-source content management system, fails to properly escape user-supplied text in file descriptions and tags within the Document Library block. An administrator or authorized user could store malicious JavaScript code that executes in the browsers of website visitors viewing the affected block, potentially allowing theft of session cookies or performing actions on behalf of the visitor.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in Concrete CMS's Document Library block. The block controller returns file description and tags values without HTML output escaping (specifically, without the h() escape function that is applied to the title column), and the block view template writes these unescaped values directly into the rendered HTML table. An authenticated user with permission to edit file properties can inject arbitrary script payloads into the description or tags fields. These payloads execute in the context of any visitor viewing a page that displays the Document Library block with the description or tags column enabled, including unauthenticated visitors. Successful exploitation could lead to session hijacking or unauthorized actions performed in the visitor's browser context. The vulnerability is fixed in Concrete CMS 9.5.3 and later.
Affected products
- Concrete CMS Concrete CMS below 9.5.3
Timeline
- 2026-09-11: disclosed