Concrete CMS versions prior to 9.5.3 do not properly escape SQL LIKE wildcard characters in keyword search filters used by the file manager, file folders, and page list. This allows authenticated users with editor-level or higher privileges to craft searches that cause the database to perform full-table scans, leading to elevated CPU and I/O usage and degraded responsiveness on large installations. The vulnerability has a low severity rating and does not involve remote code execution or data disclosure.