Detections
Analytics
SCA: security update for concrete5/concrete5 (GHSA-f73j-pm2c-rxvr)
medium Tenable Cloud Security Plugin ID 443900
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute
injection. Concrete\Core\Legacy\Pagination builds pagination links by raw-interpolating its $URL field
into href="" (<a href="{$linkURL}" …>). Any authenticated admin or report viewer with access to
`/dashboard/reports/forms/legacy` who clicks the crafted URL fires the payload in their session. The
Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.0 with vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for
reporting (CVE-2026-8245)
Solution
Update the concrete5/concrete5 library and its related packages to version 9.5.1 or later.See Also
Plugin Details
Severity: Medium
ID: 443900
Version: Revision 1.2
Type: Local
Family: SCA Checks
Published: 6/25/2026
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 2.3
Percentile: 9.42
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 5.5
Temporal Score: 4.1
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N
CVSS Score Source: CVE-2026-8245
CVSS v3
Risk Factor: Medium
Base Score: 5.4
Temporal Score: 4.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 6
Threat Score: 2.3
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 5/22/2026
Vulnerability Publication Date: 5/21/2026
Reference Information
CVE: CVE-2026-8245
cwe: CWE-83