Executive brief
Concrete CMS, a popular website content management system, contains a security flaw in its Page Attribute Display block that allows authorized content editors to inject malicious code. An attacker with page editing permissions can craft a payload in the Date Format field that executes in the browsers of all website visitors viewing the affected page, potentially compromising visitor sessions or stealing sensitive information.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Date Format field of Concrete CMS's Page Attribute Display block. An authenticated user with edit_page_contents permissions can inject arbitrary JavaScript code that persists in the database. The payload executes in the browser context of any visitor who views a page where the block is configured to display a date-type attribute, without requiring further user interaction beyond visiting the page. The vulnerability affects Concrete CMS versions below 9.5.3. Patches are available in version 9.5.3 and later.
Affected products
- Concrete CMS Concrete CMS below 9.5.3
Timeline
- 2026-09-11: disclosed