CVE-2026-8203
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Concrete CMS version 9.5.0 and below contains a stored XSS vulnerability in the height parameter. The controller does not validate or sanitize the $height value, allowing users with editor privileges to inject malicious JavaScript executed in visitors' browsers.
Risk Assessment
The risk includes the possibility of session hijacking, credential theft, or other malicious actions on the victim's account, potentially leading to confidentiality and integrity compromise.
Recommendation
It is recommended to immediately upgrade to a version above 9.5.0, which includes a fix for the height parameter validation.
Original NVD description (English source)
Concrete CMS 9.5.0 and below has Stored XSS on the height parameter. The controller does not validate or sanitize $height. Any user with editor privileges can inject malicious JavaScript that executes in the context of any visitor's browser, potentially leading to session hijacking, credential theft, or other malicious actions. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Alfin Joseph for reporting.