GitHub Advisoryadvisory · Packagist

GHSA-4pcg-pjp5-3mc6 Concrete CMS vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page

MEDIUM Published 2025-08-06 Modified 2025-08-06 Official page ↗
Aliases
CVE-2025-8571
Ecosystem
Packagist
Packages
concrete5/concrete5
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-20, CWE-79
Reviewed
2025-08-06

Affected packages

• Packagist concrete5/concrete5: < 8.5.21 → fixed in 8.5.21 • Packagist concrete5/concrete5: >= 9.0.0RC1, < 9.4.3 → fixed in 9.4.3

Description

Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages Dashboard Page. Unsanitized input could cause theft of session cookies or tokens, defacement of web content, redirection to malicious sites, and (if victim is an admin), the execution of unauthorized actions.

Related

Alias · CVE (1)

  • CVE-2025-8571 Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References