medium4.8
CVE-2026-3240
Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability
Impact
In Concrete CMS below version 9.4.8, a user with permission to edit a page with element Legacy form can perform a stored XSS attack towards high-privilege accounts via the Question field. The Concrete CMS security team thanks minhnn42, namdi and quanlna2 from VCSLab-Viettel Cyber Security for reporting.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | concrete5/concrete5 | < 9.4.8 | 9.4.8 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Concretecms | Concrete Cms | before 9.4.8 |