CVE-2025-0660 - CVE House

Back to Database

Status published Medium CVE-2025-0660

Stored XSS in Folder Function by Rogue Admin

4.8 CVSS

Vulnerability Description

Concrete CMS versions 9.0.0 through 9.3.9 are affected by a stored XSS in Folder Function.The "Add Folder" functionality lacks input sanitization, allowing a rogue admin to inject XSS payloads as folder names. The Concrete CMS security team gave this vulnerability a CVSS 4.0 Score of 4.8 with vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N. Versions below 9 are not affected. Thanks, Alfin Joseph for reporting.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-0660

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Alfin Joseph

References

More from Concrete CMS

View All →

Concrete CMS 9 through 9.4.2 is vulnerable to Stored XSS from Home Folder on Members Dashboard page

Concrete CMS 9 through 9.4.2 and below 8.5.21 is vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page

Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 - CSRF and XSS in Concrete CMS Custom Address attribute

Concrete CMS version 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block

Stored XSS in the "Top Navigator Bar" block

Affected Vendor

Concrete CMS

View all reports →

Affected Software

Concrete CMS

Vulnerable Versions:

9.0.0

Timeline

Official Publish: March 10th, 2025

Last Modified: March 11th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation