N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-8573

CVE-2025-8573: Concrete CMS is vulnerable to Stored XSS from Home Folder on Members Dashboard page

Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page. Version 8 was not affected. A rogue admin could set up a malicious folder containing XSS to which users could be directed upon login.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-8573

CVE-2025-8573:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
concrete5/concrete5	composer	>= 9.0.0RC1, < 9.4.3	9.4.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in Concrete CMS, originating from the 'Home Folder' name for users. An administrator with malicious intent could create a folder with a name containing a JavaScript payload. This name is stored in the TreeNodes table in the database.

The core of the vulnerability lies in the rendering of this folder name on the Members Dashboard without proper output escaping. The analysis of the patch f7630b467d3a234d3d333ca117046a500e7ee2b6 reveals two primary vulnerable functions where this occurs:

Concrete\Core\User\Search\ColumnSet\DefaultSet::getFolderName: This function is responsible for fetching and displaying a user's home folder name in the user list on the dashboard. The patch explicitly adds h() (a wrapper for htmlspecialchars) to the return value, confirming that it was previously outputting raw, unescaped data.
Concrete\Controller\SinglePage\Dashboard\Users\Search::getFolderList: This function retrieves all folder names, likely to populate a selection list. It was also found to be directly using the raw treeNodeName from the database. The patch applies the same h() function to prevent XSS.

Additionally, a related hardening fix was applied to Concrete\Core\Utility\Service\Url::setVariable. This function was made more robust against XSS by encoding quotes and stripping newlines from URL components. While not the direct source of the stored XSS, its modification as part of this security update suggests it could have been an attack vector for reflecting the malicious folder name within a URL parameter, which is then rendered unescaped.

An engineer seeing this CVE in their environment should understand that any user with permissions to create or rename file folders could have introduced an XSS payload, which would execute in the browsers of other administrative users viewing the Members Dashboard.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.