In Concrete CMS versions 9.0.0 through 9.5.2, the Page Container icon value submitted through the dashboard is stored without validation against a whitelist of known container icons. The stored value is later inserted directly into the src attribute of an img tag by a helper function that does not encode attribute output. This results in a stored cross-site scripting (XSS) vulnerability. An attacker with delegated access to the Page Containers dashboard can craft an icon value that breaks out of the src attribute context and executes arbitrary script in the authenticated session of other users who view the Containers dashboard list or editor views. This enables theft of session tokens and execution of privileged dashboard actions.

Successful exploitation allows an attacker with delegated dashboard access to execute arbitrary script in the context of other authenticated editors or administrators. This can lead to session token theft and unauthorized privileged actions within the dashboard, potentially compromising the integrity and security of the CMS environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict delegated access to the Page Containers dashboard to trusted users only and consider monitoring for suspicious activity related to icon value submissions. Avoid viewing the Containers dashboard with elevated privileges if untrusted users have delegated access.