CVE-2025-0660: Concrete CMS Stored XSS Vulnerability in Folder Functionality
Summary
CVE-2025-0660: Concrete CMS affected by a stored XSS in Folder Function.The "Add Folder" functionality. Affects concrete5/concrete5 versions < 9.4.0RC1. Fixed in 9.4.0RC1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Concrete CMS is an open-source content management system (CMS) that enables users to build and manage websites with ease. It offers a user-friendly interface, robust features, and flexibility for developers. However, versions 9.0.0 through 9.3.9 are vulnerable to a stored cross-site scripting (XSS) attack due to inadequate input sanitization in the 'Add Folder' functionality, which allows malicious users to inject harmful scripts as folder names.
Vulnerability Detail
The vulnerability arises from the lack of input sanitization in the 'Add Folder' feature of Concrete CMS. This oversight permits a rogue admin to input XSS payloads as folder names, which can then be executed in the context of other users' browsers. The potential ramifications include unauthorized access to sensitive information, session hijacking, and the ability to manipulate user interactions with the website. The Concrete CMS security team has assigned a CVSS score of 4.0, indicating a moderate severity level for this vulnerability.
How To Fix
Minimum fixed version
9.4.0RC1
This is the first release that contains the fix.
composer require concrete5/concrete5:9.4.0RC1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, administrators can restrict access to the 'Add Folder' functionality for non-trusted users to prevent potential exploitation until the system is updated.
Conclusion
In summary, Concrete CMS versions 9.0.0 through 9.3.9 are susceptible to a stored XSS vulnerability due to improper input sanitization in the 'Add Folder' functionality. Users are advised to update to version 9.4.0RC1 or later to mitigate this risk. Additionally, Vulert can assist in monitoring for such vulnerabilities in your applications.
See every vulnerability recorded for concrete5/concrete5 →
FAQ
CVE-2025-0660 is a stored XSS vulnerability found in Concrete CMS versions 9.0.0 to 9.3.9, allowing malicious folder names to be injected.
If you are using Concrete CMS versions 9.0.0 through 9.3.9, your installation is affected. You can check your version in the CMS dashboard.
The vulnerability can lead to unauthorized access, session hijacking, and manipulation of user interactions, posing a risk to user data and website integrity.
Yes, you can restrict access to the 'Add Folder' functionality for untrusted users as a temporary workaround until you can update.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the composer.lock file, providing real-time insights without requiring code access.
References
Related vulnerabilities
Recent vulnerabilities recorded for concrete5/concrete5.
