CVE-2026-3241 Details
Description
In Concrete CMS below version 9.4.8, a stored cross-site scripting (XSS) vulnerability exists in the "Legacy Form" block. An authenticated user with permissions to create or edit forms (e.g., a rogue administrator) can inject a persistent JavaScript payload into the options of a multiple-choice question (Checkbox List, Radio Buttons, or Select Box). This payload is then executed in the browser of any user who views the page containing the form. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks M3dium for reporting.
A stored cross-site scripting vulnerability has been identified in Concrete CMS versions prior to 9.4.8, specifically within the 'Legacy Form' block. This vulnerability allows an authenticated user with the ability to create or edit forms, such as a rogue administrator, to inject a persistent JavaScript payload into the options of multiple-choice questions, including Checkbox Lists, Radio Buttons, or Select Boxes. The injected script is executed in the browser of any user who views the page containing the form.
Users can upgrade to Concrete CMS version 9.4.8 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://documentation.concretecms.org/9-x/developers/introduction/version-history/948-release-notes | ConcreteCMS | PatchRelease NotesVendor Advisory |
| https://github.com/concretecms/concretecms/pull/12826 | ConcreteCMS | ExploitIssue TrackingVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | ConcreteCMS |
Affected Products
| Product | Versions |
|---|---|
| concretecms concrete cms | < 9.4.8 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | ConcreteCMS |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 4, 2026 | Initial Analysis | [email protected] |
| Mar 4, 2026 | New CVE Received | ConcreteCMS |