CVE-2026-18113
Received Received - Intake

Stored XSS in Concrete CMS Navigation Bar Block

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: ConcreteCMS

Description
In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could create or rename pages could store a script through a child page name and have it run in the browser of any visitor, editor, or administrator who viewed the navigation and opened the affected dropdown. In the Concrete CMS origin, the script executed with the victim's privileges and could read same-origin content or perform actions available to that user. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks labixiaoxin97 for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-18113
EUVD
EUVD-2026-78904

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
concrete_cms concrete_cms From 9.0 (inc) to 9.5.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Concrete CMS 9.0 to 9.5.2 allows a user to inject malicious scripts via child page names in the Top Navigation Bar block. The script executes in the browser of anyone viewing the navigation, potentially reading same-origin content or performing actions on behalf of the victim.

Impact Analysis

If exploited, this vulnerability could allow attackers to steal sensitive data, perform unauthorized actions, or escalate privileges within Concrete CMS. Victims include visitors, editors, and administrators who view the affected navigation dropdown.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for protecting personal and health data. Organizations may face legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Update Concrete CMS to version 9.5.3 or later to address the vulnerability. Review and remove any suspicious page names that may contain scripts in dropdown child pages. Monitor user activity for unauthorized page creations or renames.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18113. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart