GitHub Advisoryadvisory · Packagist

GHSA-9v2g-37mp-qpxf Concrete CMS has Stored XSS through its height parameter

HIGH Published 2026-05-21 Modified 2026-06-24 Official page ↗
Aliases
CVE-2026-8203
Ecosystem
Packagist
Packages
concrete5/concrete5
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-79
Reviewed
2026-06-24

Affected packages

• Packagist concrete5/concrete5: < 9.5.1 → fixed in 9.5.1

Description

Concrete CMS 9.5.0 and below has Stored XSS on the height parameter. The controller does not validate or sanitize $height. Any user with editor privileges can inject malicious JavaScript that executes in the context of any visitor's browser, potentially leading to session hijacking, credential theft, or other malicious actions.

Related

Alias · CVE (1)

  • CVE-2026-8203 Concrete CMS 9.5.0 and below has Stored XSS on the height parameter. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References