GitHub Advisoryadvisory · Packagist
GHSA-r7vr-wg3f-8hr9 Concrete5 CMS contains an XPath injection vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2022-50807
- Ecosystem
- Packagist
- Packages
- concrete5/concrete5
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-643
- Reviewed
- 2026-01-14
Affected packages
• Packagist concrete5/concrete5: 9.1.3 (no fix yet)
Description
Concrete5 CMS version 9.1.3 contains an XPath injection vulnerability that allows attackers to manipulate URL path parameters with malicious payloads. Attackers can flood the system with crafted requests to potentially extract internal content paths and system information.
Related
Alias · not in database (1)
Weakness · CWE (1)
- CWE-643 Improper Neutralization of Data within XPath Expressions weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-50807 advisory
- https://github.com/concretecms/concretecms package
- https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/concretecms.org/2022/concretecms-9.1.3 web
- https://www.concretecms.org web
- https://www.concretecms.org/download web
- https://www.exploit-db.com/exploits/51144 web
- https://www.vulncheck.com/advisories/concrete-cme-xpath-injection web