GHSA-45fj-fvmm-xcc5

ghsaUSosv

Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability

view advisory published 2026-03-04Licence: CC-BY-4.0

In Concrete CMS below version 9.4.8, a user with permission to edit a page with element Legacy form can perform a stored XSS attack towards high-privilege accounts via the Question field. The Concrete CMS security team thanks minhnn42, namdi and quanlna2 from VCSLab-Viettel Cyber Security for reporting.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-3240US	medium4.8	0.22% (13th)	—	2026-03-04
In Concrete CMS below version 9.4.8, a user with permission to edit a page with element Legacy form can perform a stored XSS attack towards high-privilege accounts via the Question…

references

External citations — patches, advisories, analysis.

https://documentation.concretecms.org/9-x/developers/introduction/version-history/948-release-notesWEB
https://github.com/concretecms/concretecmsPACKAGE
https://github.com/concretecms/concretecms/pull/12826WEB
https://nvd.nist.gov/vuln/detail/CVE-2026-3240ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan