Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability description points to a reflected XSS in the legacy pagination component of Concrete CMS. The root cause is the raw interpolation of a URL component into an HTML href attribute. By analyzing the commits between the last vulnerable version (9.5.0) and the patched version (9.5.1), I identified the security fix in commit f22b9dff59454391a50a255a39995bf635deea9e. This commit specifically modifies the concrete/src/Legacy/Pagination.php file. The getURL function within this file was changed to sanitize the URL using $this->textService->encodePath($url) before it's used. This directly addresses the reported vulnerability. The vulnerable function is therefore Pagination::getURL, as it is the function responsible for creating the unsafe URLs.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| concrete5/concrete5 | composer | < 9.5.1 | 9.5.1 |
