GitHub Advisoryadvisory · Packagist

GHSA-c5xf-rmv4-j85h Concrete CMS is vulnerable to Stored XSS from Home Folder on Members Dashboard page

LOW Published 2025-08-06 Modified 2025-08-06 Official page ↗
Aliases
CVE-2025-8573
Ecosystem
Packagist
Packages
concrete5/concrete5
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-20, CWE-79
Reviewed
2025-08-06

Affected packages

• Packagist concrete5/concrete5: >= 9.0.0RC1, < 9.4.3 → fixed in 9.4.3

Description

Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page.  Version 8 was not affected. A rogue admin could set up a malicious folder containing XSS to which users could be directed upon login.

Related

Alias · CVE (1)

  • CVE-2025-8573 Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References