GHSA-45fj-fvmm-xcc5Medium

Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability

Published
March 4, 2026
Last Modified
March 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-3240 →

📋 Description

In Concrete CMS below version 9.4.8, a user with permission to edit a page with element Legacy form can perform a stored XSS attack towards high-privilege accounts via the Question field. 

The Concrete CMS security team thanks minhnn42, namdi and quanlna2 from VCSLab-Viettel Cyber Security for reporting.

🎯 Affected products1

  • composer/concrete5/concrete5:< 9.4.8

🔗 References (4)