CVE-2026-81895
Received Received - Intake

Stored Time-Based SQL Injection in Concrete CMS

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: ConcreteCMS

Description
In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID[] without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of casting it or binding it as a parameter. An authenticated user permitted to add or edit a Document Library block could therefore persist SQL syntax in the block configuration (btDocumentLibrary.setIds), and that stored expression was executed every time the published page containing the block was rendered, producing stored, time-based blind SQL injection. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 8.5 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Habib Allah for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-81895
EUVD
EUVD-2026-78837

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
concrete_cms concrete_cms to 9.5.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored SQL injection vulnerability in Concrete CMS versions before 9.5.3. It occurs in the Document Library block where user-submitted file-set identifiers are not properly validated as integers. Instead of treating them as data, the system concatenates them directly into SQL queries, allowing attackers to inject malicious SQL syntax into the block configuration. This stored payload executes every time the affected page is viewed, enabling time-based blind SQL injection attacks.

Detection Guidance

This vulnerability requires checking Concrete CMS installations for versions before 9.5.3 and inspecting Document Library block configurations for improperly stored file-set identifiers. Review block settings for setMode and btDocumentLibrary.setIds values that may contain SQL syntax.

Impact Analysis

An authenticated user with permission to edit Document Library blocks could exploit this to execute arbitrary SQL commands on the database. This may lead to unauthorized data access, modification, or deletion. Attackers could steal sensitive information, manipulate content, or gain full control over the CMS if combined with other vulnerabilities. The impact depends on the database permissions and the attacker's goals.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to personal or protected health information stored in the database. A successful exploit may result in data breaches, leading to regulatory fines, legal liabilities, and reputational damage. Organizations using vulnerable versions must patch immediately to maintain compliance.

Mitigation Strategies

Upgrade Concrete CMS to version 9.5.3 or later immediately. Remove any suspicious SQL syntax from Document Library block configurations, particularly in btDocumentLibrary.setIds fields. Restrict authenticated user permissions to prevent unauthorized block edits.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81895. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart