Executive brief
Concrete CMS, a popular content management system, is vulnerable to a security flaw in its legacy pagination component. An attacker can create a malicious link that, if clicked by an administrator or report viewer, allows the attacker to execute unauthorized scripts in the victim's browser session. This could lead to the theft of sensitive session information or unauthorized actions being performed on the website.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Concrete CMS versions 9.5.0 and below within the Legacy Pagination component. The root cause is the raw interpolation of the $URL field into the href attribute of pagination links in Concrete\Core\Legacy\Pagination. An attacker can craft a malicious URL that injects HTML attributes/scripts. When an authenticated administrator or report viewer with access to the legacy reports dashboard (/dashboard/reports/forms/legacy) clicks this crafted link, the payload executes within their session context. This vulnerability is tracked as CVE-2026-8245 and is fixed in version 9.5.1.
Affected products
- Concrete CMS Concrete CMS <= 9.5.0
Timeline
- 2026-05-21: disclosed: NVD Published Date
- 2026-05-22: advisory: GitHub Advisory published
- 2026-05-22: patched: Version 9.5.1 released with fix