EUVD-2026-78161
GHSA-rwvw-4pc9-743m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Editor canWrite role maps to PR:L; scope changes to admin session (S:C); admin must open Sitemap panel (UI:R); full session compromise yields C:H/I:H.
Primary rating from Vendor (ff5b8ace-8b95-4078-9743-eac1ca5451de).
CVSS VectorVendor: ff5b8ace-8b95-4078-9743-eac1ca5451de
Lifecycle Timeline
2DescriptionCVE.org
Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name (customAliasName) because the Edit Alias dialog applied only trim() to the submitted value and performed no input neutralization. An authenticated user holding canWrite (editor) permission on a page could store a malicious alias name that was later rendered unescaped in the administrative Sitemap panel, where it executed automatically in any administrator or editor session that opened the panel, allowing an editor to escalate to administrator through the victim's active session. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N. Thanks Nguyen Manh Thuan for reporting.
AnalysisAI
Stored XSS in Concrete CMS 9.0.0-9.5.2 allows an authenticated editor to escalate privileges to administrator by injecting malicious JavaScript into the custom page alias name (customAliasName) field. The Edit Alias dialog applied only a trim() call to the submitted value with no HTML encoding or output neutralization, causing the alias to render unescaped in the administrative Sitemap panel. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold an authenticated Concrete CMS account with canWrite (editor) permission on at least one page - this role is commonly granted in multi-user CMS deployments to content authors but is not the default for unauthenticated or newly registered users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 4.0 score of 7.3 accurately reflects a meaningful but access-constrained threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Concrete CMS 9.5.3 or later, which resolves this vulnerability per the official release notes at https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Concrete CMS 9.0.0-9.5.2 instances to identify users with editor or administrator roles and document current access assignments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today