CVE-2026-3244
Description
In Concrete CMS below version 9.4.8, A stored cross-site scripting (XSS) vulnerability exists in the search block where page names and content are rendered without proper HTML encoding in search results. This allows authenticated, rogue administrators to inject malicious JavaScript through page names that executes when users search for and view those pages in search results. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks zolpak for reporting
How to fix
- concretecms concrete_cms9.4.8 or later
- concrete5/concrete59.4.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| concretecms concrete_cms | v < 9.4.8 | 9.4.8 |
| concrete5/concrete5Packagist | v < 9.4.8 | 9.4.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.