CVE-2025-8571 Concrete CMS vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page
Attackers can inject malicious scripts into the Conversation Messages Dashboard Page to steal session cookies or perform unauthorized actions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-8571?
CVE-2025-8571 is a medium-severity cross-site scripting vulnerability in Concretecms Concrete Cms, published on 5 Aug 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages Dashboard Page. Unsanitized input could cause theft of session cookies or tokens, defacement of web content, redirection to malicious sites, and (if victim is an admin), the execution of unauthorized actions. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Fortbridge https://fortbridge.co.uk/ for performing a penetration test and vulnerability assessment on Concrete CMS and reporting this issue.
Which versions are affected by CVE-2025-8571?
4 open source packages ship an affected version, including concrete5/concrete5. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
concrete5/concrete5 Packagist | All versions | 8.5.21 |
concrete5/concrete5 Packagist | All versions | 8.5.21 |
concrete5/concrete5 Packagist | From 9.0.0RC1 | 9.4.3 |
concrete5/concrete5 Packagist | From 9.0.0RC1 | 9.4.3 |
Products include Concretecms Concrete Cms.
How do I fix CVE-2025-8571?
Upgrade concrete5/concrete5 to a fixed version for your release line: 8.5.21 or 9.4.3.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-8571 being exploited?
There is no known exploitation of CVE-2025-8571 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Concretecms Concrete Cms
- CVE-2023-48648 Concrete CMS allows unauthorized access because directories can be created with insecure permissions
- CVE-2022-21829 Code injection in concrete CMS
- CVE-2021-22958 Server-Side Request Forgery vulnerability in concrete5
- CVE-2021-40098 Path traversal in n/a
- CVE-2026-8134 Concrete CMS Vulnerable to Relative Path Traversal
Sources
Also known as GHSA-4pcg-pjp5-3mc6.