Vulnerabilities

Concrete CMS versions before 9.5.3 fail to escape or integer-cast the stored width and height values of the YouTube block, applying only a trim() before printing them into iframe HTML attributes, which allows stored cross-site scripting. A user with edit_block permission on the YouTube block can inject an event handler (e.g., in the width/height attribute values) that executes attacker-controlled JavaScript in the browser of any visitor rendering the page. If the victim is an administrator, the injected script runs with administrative privileges, enabling actions such as creating new admin accounts or modifying site content and settings. Affected installations are those running Concrete CMS before 9.5.3 where users with edit_block permission are not fully trusted. No public proof of concept is known, the flaw is not in CISA's KEV catalog, and there is no evidence of in-the-wild exploitation at this time.

Do: Upgrade to Concrete CMS 9.5.3 or later, which escapes/casts the YouTube block's width and height values. Review existing YouTube blocks for unexpected HTML event-handler content in the width and height fields and check block version history for suspicious edits by low-privileged users. Restrict edit_block permissions on pages to trusted staff, since the flaw requires an account with editing rights to exploit, and consider rotating admin sessions if a compromised editor is identified.

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer (color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and ImageStyle) are interpolated into server-compiled LESS source without neutralization of LESS syntax, allowing a user with the Theme Customization permission to inject arbitrary LESS directives. By injecting the @import (inline) directive, an attacker can read arbitrary files on the server and reach internal network resources through PHP stream wrappers. The compiled output, including any disclosed file contents, is written to the site's publicly served CSS cache, exposing database credentials, private keys, and other application secrets, and enabling server-side request forgery. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.9 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.