CVE-2026-8203

Vulnerability

Overview CVE-2026-8203 is a stored cross-site scripting (XSS) vulnerability in Concrete CMS versions 9.5.0 and below. The root cause lies in the controller handling the height parameter, which performs no validation or sanitization of user-supplied input. This allows any user with editor privileges to inject arbitrary JavaScript code that is stored and later executed in the context of visitors' browsers [1].

Attack

Surface and Exploitation The attacker must have editor privileges, but no special network position is required. The vulnerable parameter is processed without sanitization, enabling the injection of malicious scripts directly into the application's output. The CVSS v4.0 score of 7.3 (AV:N/AC:H/AT:P/PR:H/UI:P) reflects the high privileges needed but also the potential for serious impact when combined with social engineering [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in every visitor's browser session. This can lead to session hijacking, theft of credentials, or other malicious actions that compromise user accounts and data [1].

Mitigation

Concrete CMS version 9.5.1 addresses this vulnerability by sanitizing the height parameter. Users are strongly advised to upgrade to 9.5.1 or later. No workaround is documented for older versions [1].