CVE-2026-8203: Concrete CMS 9.5.0 and below has Stored XSS on the height parameter
Concrete CMS 9.5.0 and below has Stored XSS on the height parameter. The controller does not validate or sanitize $height. Any user with editor privileges can inject malicious JavaScript that executes in the context of any visitor's browser, potentially leading to session hijacking, credential theft, or other malicious actions. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Alfin Joseph for reporting.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8203?
CVE-2026-8203 has a high severity rating of 7.3 according to the CVSS.
How do I fix CVE-2026-8203?
To fix CVE-2026-8203, update Concrete CMS to version 9.5.1 or higher to ensure proper validation and sanitization of the height parameter.
What is the risk associated with CVE-2026-8203?
The risk associated with CVE-2026-8203 is a score of 47, indicating a significant potential for exploitation.
What type of vulnerability is CVE-2026-8203?
CVE-2026-8203 is categorized as a Stored XSS vulnerability that affects versions of Concrete CMS 9.5.0 and below.
Who is affected by CVE-2026-8203?
Any user with editor privileges on Concrete CMS 9.5.0 and below can exploit CVE-2026-8203 to inject malicious JavaScript.