CVE-2026-68531

EUVD-2026-79178 LOW

Asymmetric Resource Consumption (Amplification) (CWE-405)

2026-09-15 ff5b8ace-8b95-4078-9743-eac1ca5451de

GHSA-mcfm-6jvw-6qf6

Information Disclosure

2.1

CVSS 4.0 · Vendor: ff5b8ace-8b95-4078-9743-eac1ca5451de

Severity by source

Vendor (ff5b8ace-8b95-4078-9743-eac1ca5451de) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (ff5b8ace-8b95-4078-9743-eac1ca5451de) · only source for this CVE.

CVSS VectorVendor: ff5b8ace-8b95-4078-9743-eac1ca5451de

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 19:31 vuln.today

DescriptionCVE.org

Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the keyword search filters used by the file manager, file folders, and page list, allowing an authenticated user with editor-level or higher privileges to submit a crafted search containing many single-character wildcards. Because the keyword input was placed into the LIKE clause without neutralizing its wildcard metacharacters, a short request could force the database to evaluate every row and perform a full-table scan, and repeated or wildcard-dense searches could sustain elevated database CPU and I/O, degrading responsiveness for other users on large installations. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N. Thanks noivan for reporting.

AnalysisAI

Authenticated users with editor-level or higher privileges in Concrete CMS 9.x before 9.5.3 can degrade site availability by submitting keyword searches packed with SQL LIKE wildcard characters, which the application failed to escape before placing them into the LIKE clause. Because a single-character wildcard matches any row, a short request forces the database into full-table scans, and repeated or wildcard-dense searches can sustain elevated database CPU and I/O on large installations, slowing the site for all users. …