Concrete CMS prior to version 9.5.3 fails to apply HTML output escaping to the file description and tags fields when rendering the Document Library block. A user with edit permissions can store malicious script payloads in these fields, which execute in the browsers of any page visitors viewing the block with description or tags columns enabled. This cross-site scripting (XSS) vulnerability could allow attackers to steal session data or perform actions on behalf of the visitor. The vulnerability is due to the block controller returning unescaped description and tags values, and the block view template directly injecting these into the HTML output without escaping. The Concrete CMS security team assigned a CVSS v4.0 score of 5.1 (medium severity) to this issue.

Successful exploitation allows script execution in the context of visitors' browsers, including unauthenticated users. This can lead to theft of session data or unauthorized actions performed in the visitor's context. The vulnerability requires a user with permission to edit file properties to inject the malicious payload.

A fix is available in Concrete CMS version 9.5.3. Users should upgrade to version 9.5.3 or later to remediate this vulnerability. No other mitigation steps are indicated by the vendor advisory.