CVE-2026-8245: Concrete CMS is Vulnerable to Reflected XSS in Legacy Pagination

May 22, 2026 (updated June 24, 2026)

Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection. Concrete\Core\Legacy\Pagination builds pagination links by raw-interpolating its $URL field into href="" (<a href="{$linkURL}" …>). Any authenticated admin or report viewer with access to /dashboard/reports/forms/legacy who clicks the crafted URL fires the payload in their session.

References

documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes
github.com/advisories/GHSA-f73j-pm2c-rxvr
nvd.nist.gov/vuln/detail/CVE-2026-8245

Code Behaviors & Features

Detect and mitigate CVE-2026-8245 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →