SQL Injection Vulnerability in Concrete CMS by Concrete5
CVE-2026-68531

2.1LOW

Key Information:

Vendor

Concrete Cms

Status
Concrete Cms
Vendor
CVE Published:
15 September 2026

What is CVE-2026-68531?

A SQL injection vulnerability exists in Concrete CMS versions prior to 9.5.3 that does not properly escape SQL LIKE wildcard characters in the file manager and page list keyword search filters. This issue allows authenticated users with editor-level privileges to execute crafted searches filled with single-character wildcards, leading to full-table scans in the database. Such operations can significantly degrade performance and responsiveness for other users on large installations due to excessive CPU and I/O usage. The Concrete CMS team has addressed this issue in the latest version to enhance security and performance.

Affected Version(s)

Concrete CMS 9.0.0 <= 9.5.2

References

https://documentation.concretecms.org/developers/introduc...
release-notes

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

noivan
.