Executive brief
Concrete CMS, a content management system, contains a stored cross-site scripting vulnerability in its SVG file upload feature. When configured in a non-default "reject" mode, the system fails to properly sanitize SVG files, allowing an attacker with file upload permissions to inject malicious code that executes in the browsers of any user who views the uploaded file. This could lead to unauthorized account access, data theft, or malware distribution.
Technical details
The vulnerability is a stored XSS flaw in SVG file handling when the svg_sanitization.action is set to "reject" mode. The vulnerability exists because the sanitization logic only checks against a small built-in blocklist (script element and on* event handlers) but discards the results of the broader enshrined/svg-sanitize library, allowing vectors like javascript: URIs in xlink:href attributes to pass through unstripped. An authenticated user with file upload privileges can upload a malicious SVG file containing JavaScript code, which will execute in the browser context of any user who directly opens the file. The default "sanitize" mode is not affected. A patch is available in Concrete CMS version 9.5.3 and later.
Affected products
- Concrete CMS Concrete CMS before 9.5.3
Timeline
- 2026-09-15: disclosed