CVE-2026-3244

Description

In Concrete CMS below version 9.4.8, A stored cross-site scripting (XSS) vulnerability exists in the search block where page names and content are rendered without proper HTML encoding in search results. This allows authenticated, rogue administrators to inject malicious JavaScript through page names that executes when users search for and view those pages in search results. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks zolpak for reporting

PUBLISHED Reserved 2026-02-26 | Published 2026-03-04 | Updated 2026-03-04 | Assigner ConcreteCMS

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Credits

zolpak reporter

References

github.com/concretecms/concretecms/pull/12826

documentation.concretecms.org/...n-history/948-release-notes

cve.org (CVE-2026-3244)

nvd.nist.gov (CVE-2026-3244)

Download JSON