CVE-2026-3244 - Vulnerability Analysis

Overview

Concrete CMS < 9.4.8 contains a stored cross-site scripting vulnerability caused by improper HTML encoding of page names and content in the search block, letting authenticated rogue administrators inject malicious JavaScript, exploit requires authenticated admin privileges.

Severity & Score

Impact

Authenticated rogue administrators can inject malicious JavaScript that executes when users view search results, potentially leading to user session compromise or actions on behalf of users.

Mitigation

Update to version 9.4.8 or later.

References

• https://documentation.concretecms.org/9-x/developers/introduction/version-history/948-release-notes
• https://github.com/concretecms/concretecms/pull/12826

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner