PT-2026-22862 · Unknown · Concrete Cms

Zolpak · Published 2026-03-04 · Updated 2026-03-04 · CVE-2026-3244

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.4.8

Description A stored cross-site scripting (XSS) issue exists in the search block of the software. Page names and content are rendered without proper HTML encoding in search results, allowing authenticated administrators to inject malicious JavaScript through page names. This JavaScript executes when users search for and view those pages in search results.

Recommendations Update to version 9.4.8 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3244

GHSA-MM5F-5RQW-574F

Affected Products

Concrete Cms

References · 10

• https://github.com/concretecms/concretecms/pull/12826 · Vendor Advisory
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/948-release-notes · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mm5f-5rqw-574f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3244 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3244 · Vendor Advisory
• https://github.com/concretecms/concretecms · Note
• https://t.me/CVEtracker/46271 · Telegram Post
• https://t.me/cveNotify/154224 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2029034299555541411 · Twitter Post
• https://twitter.com/CVEarity/status/2029168108888572005 · Twitter Post