Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a stored Cross-Site Scripting (XSS) in the 'height' parameter of the Hero Image block in Concrete CMS. The analysis of the security patch between versions 9.5.0 and 9.5.1 reveals that the save() method within the concrete/blocks/hero_image/controller.php file was modified to address this. Before the patch, the $height parameter, which is part of the $args array passed to the save() method, was not sanitized. An attacker with editor privileges could provide a malicious script as the value for the height parameter. This script would then be stored in the database. When the Hero Image block is rendered, the unsanitized height value is used, leading to the execution of the malicious script in the browser of any user viewing the page. The fix, as seen in the patch, is to cast the height parameter to an integer ((int) $args['height']). This ensures that only a numerical value is stored, effectively neutralizing the XSS threat.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| concrete5/concrete5 | composer | < 9.5.1 | 9.5.1 |
