Which versions of Concrete CMS are affected by CVE-2026-8203?

Concrete CMS versions 9.5.0 and earlier contain a stored cross-site scripting vulnerability permitting authenticated editors to inject persistent malicious code affecting all site visitors.. A patch is available.

How to fix or mitigate CVE-2026-8203?

Within 24 hours: Inventory all Concrete CMS instances and document version numbers; immediately restrict editor role access to only essential, trusted personnel. Within 7 days: Request security updates or workarounds from Concrete CMS vendor; implement server-side input validation and sanitization specifically on the 'height' parameter and all editor-controlled inputs. Within 30 days: Deploy Content Security Policy (CSP) headers restricting script sources to same-origin; enable comprehensive output encoding on all editor-submitted content; establish automated scanning of published content for JavaScript injection patterns.

Concrete CMS CVE-2026-8203

Q: What is the CVSS score of CVE-2026-8203?

CVE-2026-8203 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31341 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-21 ff5b8ace-8b95-4078-9743-eac1ca5451de

GHSA-9v2g-37mp-qpxf

XSS Concrete Cms Concretecms

7.3

CVSS 4.0 · Vendor: ff5b8ace-8b95-4078-9743-eac1ca5451de

Severity by source

Vendor (ff5b8ace-8b95-4078-9743-eac1ca5451de) PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (ff5b8ace-8b95-4078-9743-eac1ca5451de) · only source for this CVE.

CVSS VectorVendor: ff5b8ace-8b95-4078-9743-eac1ca5451de

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 21:33 vuln.today

DescriptionCVE.org

Concrete CMS 9.5.0 and below has Stored XSS on the height parameter. The controller does not validate or sanitize $height. Any user with editor privileges can inject malicious JavaScript that executes in the context of any visitor's browser, potentially leading to session hijacking, credential theft, or other malicious actions. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Alfin Joseph for reporting.

AnalysisAI

Stored cross-site scripting in Concrete CMS 9.5.0 and earlier allows authenticated editors to inject persistent JavaScript via the unvalidated 'height' parameter, executing in any subsequent visitor's browser. The CVSS 4.0 score of 7.3 reflects high privilege requirements (editor role) combined with high impact, and no public exploit identified at time of analysis.

Technical ContextAI

Concrete CMS is an open-source PHP content management system. The vulnerability is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) issue in which a controller accepts a $height parameter but fails to perform validation or output encoding before rendering it back into a page template. Because the unsanitized value is stored server-side and re-served to other users, this is a persistent (Type 2) XSS rather than a reflected variant - meaning the payload survives the original request and triggers on subsequent page loads by other users including site administrators.

RemediationAI

Upgrade Concrete CMS to version 9.5.1 or later, which addresses the unsanitized height parameter per the vendor release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes. If immediate upgrade is not possible, compensating controls include restricting editor-role assignments to fully trusted users only (side effect: reduces content contribution flexibility), implementing a strict Content Security Policy that disallows inline scripts on rendered pages (side effect: may break legitimate inline JS in custom themes/blocks and require refactoring), and monitoring audit logs for unexpected modifications to block/page properties carrying the height attribute. Forcing administrators to use a separate browser profile or session when reviewing editor-submitted content reduces the blast radius of a successful XSS firing against an admin.