Stored XSS Vulnerability in Concrete CMS by Concrete Solutions

CVE-2025-0660

What is CVE-2025-0660?

Concrete CMS, specifically versions 9.0.0 through 9.3.9, is susceptible to a stored XSS vulnerability in the 'Add Folder' feature. This occurs due to inadequate input sanitization, which permits a rogue administrator to inject malicious XSS payloads as folder names. As a result, unauthorized scripts could be executed in the browser of users who access these manipulated folder names, posing significant security threats.

References