CVE-2026-68531: Concrete CMS below 9.5.3 is vulnerable to Authenticated Denial of Service via Unescaped SQL LIKE Wildcards in Keyword Search
Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the keyword search filters used by the file manager, file folders, and page list, allowing an authenticated user with editor-level or higher privileges to submit a crafted search containing many single-character wildcards. Because the keyword input was placed into the LIKE clause without neutralizing its wildcard metacharacters, a short request could force the database to evaluate every row and perform a full-table scan, and repeated or wildcard-dense searches could sustain elevated database CPU and I/O, degrading responsiveness for other users on large installations. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N. Thanks noivan for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 9.5.3 - Configuration
Update the keyword search filter handling used by the file manager, file folders, and page list so SQL LIKE wildcard metacharacters in user-supplied keyword input are escaped/neutralized before being used in the SQL LIKE clause (to prevent full-table scans and sustained high CPU/I/O from wildcard-dense searches).
Concrete CMS file manager / file folders / page list keyword search filters SQL LIKE wildcard escaping in keyword search filters = Escapes SQL LIKE wildcard metacharacters so they are neutralized before being placed into the LIKE clause
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with editor-level or higher privileges can submit the crafted keyword searches. Unauthenticated visitors and users below editor level are not identified as able to exploit it.
Which features are affected?
The affected keyword search filters are used by the file manager, file folders, and page list. Large installations are most likely to experience noticeable degradation because the searches can force full-table database scans.
What does an attacker need to do?
The attacker needs valid editor-level-or-higher access and must submit a crafted search containing many single-character SQL LIKE wildcards. Repeated or wildcard-dense searches can maintain elevated database CPU and I/O usage.
What version resolves the issue?
Concrete CMS 9.5.3 resolves the issue; versions of Concrete CMS 9 before 9.5.3 are affected.