MEDIUM
GHSA-4pcg-pjp5-3mc6
Concrete CMS vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page
Quick fix
GHSA-4pcg-pjp5-3mc6 — concrete5/concrete5: upgrade to the fixed version with the command below.
composer require concrete5/concrete5:^8.5.21Details
Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages Dashboard Page. Unsanitized input could cause theft of session cookies or tokens, defacement of web content, redirection to malicious sites, and (if victim is an admin), the execution of unauthorized actions.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/concrete5/concrete5
Introduced in:
0Fixed in: 8.5.21Fix
composer require concrete5/concrete5:^8.5.21Packagist/concrete5/concrete5
Introduced in:
9.0.0RC1Fixed in: 9.4.3Fix
composer require concrete5/concrete5:^9.4.3References
- https://nvd.nist.gov/vuln/detail/CVE-2025-8571[ADVISORY]
- https://github.com/concretecms/concretecms/commit/4b39dcc17c309dc82eb8398e8cdb146942f62f92[WEB]
- https://github.com/concretecms/concretecms/commit/f7630b467d3a234d3d333ca117046a500e7ee2b6[WEB]
- https://documentation.concretecms.org/9-x/developers/introduction/version-history/943-release-notes[WEB]
- https://documentation.concretecms.org/developers/introduction/version-history/8521-release-notes[WEB]
- https://github.com/concretecms/concretecms[PACKAGE]
- https://www.concretecms.org/download[WEB]