CVE-2022-50807
Critical · 9.8Concrete5 CMS contains an XPath injection vulnerability
CVSS
9.8
EPSS
—
Published
Jan 14, 2026
CISA due date
—
The record
Concrete5 CMS version 9.1.3 contains an XPath injection vulnerability that allows attackers to manipulate URL path parameters with malicious payloads. Attackers can flood the system with crafted requests to potentially extract internal content paths and system information.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | concrete5/concrete5 | 9.1.3 | No fix |
| packagist | concrete5/concrete5 | 9.1.3 | No fix |
Related vulnerabilities
- GHSA-r7vr-wg3f-8hr9 Concrete5 CMS contains an XPath injection vulnerability Same vulnerability
- GHSA-w9qg-chfh-g3q9 Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability Also affects concrete5/concrete5
- GHSA-45fj-fvmm-xcc5 Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability Also affects concrete5/concrete5
- GHSA-6mxw-2vhf-42g5 Concrete CMS vulnerable to Cross-Site Request Forgery (CSRF) Also affects concrete5/concrete5
- GHSA-f4vq-pj32-gr4q Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability Also affects concrete5/concrete5
- GHSA-gj26-w59c-29mf Concrete CMS vulnerable to Remote Code Execution by stored PHP object injection Also affects concrete5/concrete5
- GHSA-mm5f-5rqw-574f Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability Also affects concrete5/concrete5
- CVE-2026-3241 In Concrete CMS below version 9.4.8, a stored cross-site scripting (XSS) vulnerability… Also affects concrete5/concrete5