Concrete CMS (previously concrete5) is vulnerable to stored XSS in uploaded file and folder names

Description

References

• nvd.nist.gov/vuln/detail/CVE-2023-28819 · ADVISORY
• concretecms/concretecms#11749 · WEB
• concretecms/concretecms release · WEB
• concretecms/concretecms release 8.5.13 · WEB
• concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release · WEB
• concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20 · WEB

Weitere Schwachstellen in concrete5/concrete5

• CVE-2026-10721HOCH 8.4Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the  in Permission, Cache, and Search components. …
• CVE-2026-7888HOCH 8.4Concrete CMS below 9.5.3 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components …
• CVE-2026-8353MITTEL 4.8Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in the Atomik theme. A rogue editor can inject arbitrary JavaScr…
• CVE-2026-8347MITTEL 4.3Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog.  This can cause Cr…
• CVE-2026-8340MITTEL 4.3Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion. Victim with edit_file_contents permission is CSRF'd int…