CVE-2026-3240: Concrete CMS below 9.4.8 is vulnerable to Stored XSS via Legacy form
In Concrete CMS below version 9.4.8, a user with permission to edit a page with element Legacy form can perform a stored XSS attack towards high-privilege accounts via the Question field.
The Concrete CMS security team thanks minhnn42, namdi and quanlna2 from VCSLab-Viettel Cyber Security for reporting.
Other sources
In Concrete CMS below version 9.4.8, a user with permission to edit a page with element Legacy form can perform a stored XSS attack towards high-privilege accounts via the Question field. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Thanks minhnn42, namdi and quanlna2 from VCSLab-Viettel Cyber Security for reporting.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3240?
CVE-2026-3240 is considered a high severity vulnerability due to its potential for stored XSS attacks impacting high-privilege accounts.
How do I fix CVE-2026-3240?
To fix CVE-2026-3240, upgrade Concrete CMS to version 9.4.8 or later.
What products are affected by CVE-2026-3240?
CVE-2026-3240 affects Concrete CMS versions below 9.4.8.
What type of vulnerability is CVE-2026-3240?
CVE-2026-3240 is a Stored Cross-Site Scripting (XSS) vulnerability.
Who can exploit CVE-2026-3240?
A user with permission to edit a page containing the Legacy form can exploit CVE-2026-3240.