Concrete CMS is Vulnerable to Reflected XSS in Legacy Pagination
Date: 2026-05
Affected: composer/concrete5/concrete5
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-8245
CWE: CWE-83

Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection. Concrete\Core\Legacy\Pagination builds pagination links by raw-interpolating its $URL field into href="" (<a href="{$linkURL}" …>). Any authenticated admin or report viewer with access to `/dashboard/reports/forms/legacy` who clicks the crafted URL fires the payload in their session.


Mitigations:

Architectural layers (MAESTRO):