PT-2026-2973 · Packagist · Concrete5/Concrete5

Published 2026-01-14 · Updated 2026-01-14

OSV

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Concrete5 CMS version 9.1.3 contains an XPath injection vulnerability that allows attackers to manipulate URL path parameters with malicious payloads. Attackers can flood the system with crafted requests to potentially extract internal content paths and system information.

Exploit

Fix

Weakness Enumeration

CWE-643

Related Identifiers

GHSA-R7VR-WG3F-8HR9

Affected Products

Concrete5/Concrete5

References · 8

• 🔥 https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/concretecms.org/2022/concretecms-9.1.3 · Exploit
• https://osv.dev/vulnerability/GHSA-r7vr-wg3f-8hr9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50807 · Security Note
• https://github.com/concretecms/concretecms · Note
• https://concretecms.org · Note
• https://concretecms.org/download · Note
• https://vulncheck.com/advisories/concrete-cme-xpath-injection · Note
• https://exploit-db.com/exploits/51144 · Note