Concrete CMS Stored Cross-Site Scripting Vulnerability in Folder Function

A stored cross-site scripting vulnerability has been identified in Concrete CMS versions 9.0.0 through 9.3.9, within the Folder Function's 'Add Folder' feature. This issue arises because the functionality does not properly sanitize input, allowing a malicious admin to inject XSS payloads into folder names. Versions prior to 9.0 are not affected.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users can update to Concrete CMS version 9.4.0 or later, where this vulnerability has been addressed. Instructions for updating Concrete CMS are available in the Concrete CMS documentation.