Concrete CMS before version 9.5.3 improperly neutralizes user-supplied custom date formats when rendering conversation messages, leading to a reflected cross-site scripting vulnerability (CWE-79). An attacker can exploit this by tricking a user into submitting a crafted POST request to the conversation view endpoint, which lacks CSRF protection, allowing execution of arbitrary JavaScript in the victim's browser. The vulnerability has a CVSS v4.0 base score of 2.1, indicating low severity. No known exploits in the wild have been reported. No patch links or vendor advisory details are provided in the input data.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session when interacting with the conversation view endpoint. This could lead to session hijacking or other client-side attacks. However, the low CVSS score and requirement for user interaction reduce the overall risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with conversation messages and avoid submitting untrusted POST requests. The absence of a CSRF token on the endpoint suggests that adding CSRF protection would mitigate the issue.