EUVD-2026-78205
GHSA-c87m-38hc-rc4g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires high-privilege edit_block account (PR:H) and victim page visit (UI:R); scope changes to victim's browser enabling full admin session compromise with no direct availability impact.
Primary rating from Vendor (ff5b8ace-8b95-4078-9743-eac1ca5451de).
CVSS VectorVendor: ff5b8ace-8b95-4078-9743-eac1ca5451de
Lifecycle Timeline
2DescriptionCVE.org
Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML attributes without escaping or integer casting, resulting in stored cross-site scripting. A user with edit_block permission could inject an event handler that executed script for visitors rendering the page, acting with administrative privileges where the victim was an administrator. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks sh4d0byss for reporting.
AnalysisAI
Stored XSS in Concrete CMS before 9.5.3 allows a user with edit_block permission to inject malicious JavaScript into a page's YouTube embed block by supplying an unsanitized iframe width or height value. Because only PHP's trim() is applied before the values are written into HTML attribute context, an attacker can persist an event-handler payload that executes in every visitor's browser - and, when the victim holds administrative privileges, the script acts with those privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two concrete prerequisites must be met: (1) the attacker must possess a Concrete CMS account with the edit_block permission - a role typically assigned to trusted content editors, not anonymous users - and (2) the target site must have the YouTube embed block placed on at least one page. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 4.0 score of 7.3 (AV:N/AC:L/AT:P/PR:H/UI:P) is internally consistent with the description and reflects real constraints: exploitation demands both a high-privilege editor account (PR:H) and a victim page visit (UI:P), with AT:P acknowledging the prerequisite that an administrator must actually render the poisoned block. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Concrete CMS 9.5.3, which applies proper output escaping or integer casting to YouTube block width and height values before HTML rendering. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all YouTube embed blocks created in the past 90 days for suspicious width/height attributes and restrict edit_block permissions to essential personnel only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today