CVE-2025-8571 json
Concrete CMS 9 through 9.4.2 and below 8.5.21 is vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page
published 2025-08-05 15 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-23658 , GHSA-4pcg-pjp5-3mc6
- cvss
- 4.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 32%
- public exploits
- 0
- none known
Summary
Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages Dashboard Page. Unsanitized input could cause theft of session cookies or tokens, defacement of web content, redirection to malicious sites, and (if victim is an admin), the execution of unauthorized actions. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Fortbridge https://fortbridge.co.uk/ for performing a penetration test and vulnerability assessment on Concrete CMS and reporting this issue.
Patch / fix
- packagist concrete5/concrete5 8.5.21, 9.4.3
- Concrete CMS Concrete CMS 8.5.21, 9.4.3
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 15 mo ago
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 4.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 4.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | concrete5/concrete5 | <8.5.21 >=9.0.0RC1, <9.4.3 |
8.5.21 9.4.3 |
Affected products
- Concrete CMS Concrete CMS
Classification
References
-
github.com
/concretecms/concretecms/commit/4b39dcc17c309dc82eb8398e8cdb146942f62f92
web
-
github.com
/concretecms/concretecms/commit/f7630b467d3a234d3d333ca117046a500e7ee2b6
web
-
documentation.concretecms.org
/developers/introduction/version-history/8521-release-notes
web, release-notes
-
documentation.concretecms.org
/9-x/developers/introduction/version-history/943-release-notes
web, release-notes
-
concretecms.org
/download
web, product
-
nvd.nist.gov
/vuln/detail/CVE-2025-8571
advisory
-
github.com
/concretecms/concretecms
package
Sources
- CVE List CVE-2025-8571
- GitHub Advisory GHSA-4pcg-pjp5-3mc6
- NVD CVE-2025-8571
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.