CVE-2026-3241: Concrete CMS below version 9.4.8 is vulnerable to a stored cross-site scripting (XSS) in the "Legacy Form" block.
In Concrete CMS below version 9.4.8, a Cross-site Scripting (XSS) vulnerability exists in the "Legacy Form" block. An authenticated user with permissions to create or edit forms (e.g., a rogue administrator) can inject a persistent JavaScript payload into the options of a multiple-choice question (Checkbox List, Radio Buttons, or Select Box). This payload is then executed in the browser of any user who views the page containing the form.
The Concrete CMS security team thanks M3dium for reporting.
Other sources
In Concrete CMS below version 9.4.8, a stored cross-site scripting (XSS) vulnerability exists in the "Legacy Form" block. An authenticated user with permissions to create or edit forms (e.g., a rogue administrator) can inject a persistent JavaScript payload into the options of a multiple-choice question (Checkbox List, Radio Buttons, or Select Box). This payload is then executed in the browser of any user who views the page containing the form. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks M3dium for reporting.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3241?
CVE-2026-3241 has a medium severity rating due to the potential for authenticated users to exploit stored cross-site scripting (XSS) vulnerabilities.
How do I fix CVE-2026-3241?
To fix CVE-2026-3241, upgrade Concrete CMS to version 9.4.8 or later.
Who is affected by CVE-2026-3241?
All users of Concrete CMS versions below 9.4.8 are affected by CVE-2026-3241.
What type of vulnerability is CVE-2026-3241?
CVE-2026-3241 is classified as a stored cross-site scripting (XSS) vulnerability.
What components are involved in CVE-2026-3241?
CVE-2026-3241 specifically affects the 'Legacy Form' block in Concrete CMS.