CVE-2026-81898
Received Received - Intake

Stored XSS in Concrete CMS Address Attribute

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: ConcreteCMS

Description
In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user able to submit an Address attribute could execute script in the session of any dashboard user who opened the affected entry. The unescaped branch was reachable because a non-required Address attribute accepted a blank country, and because several Express association templates (for example concrete/elements/express/form/view/dashboard/association.php) echoed the association label mask without applying h(). The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-81898
EUVD
EUVD-2026-78900

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
concrete_cms concrete_cms to 9.5.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Concrete CMS versions below 9.5.3. It occurs in the Address attribute's country-less text formatter, which fails to escape HTML properly. Attackers can inject malicious scripts via an Address attribute submission, which then executes in the browser of any dashboard user viewing the affected entry.

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of users, or deface the dashboard. Users with access to the dashboard are at risk if they view entries containing the malicious Address attribute. The impact includes potential data breaches or unauthorized control of the CMS.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations may face compliance breaches if user data is compromised through this exploit.

Mitigation Strategies

Upgrade Concrete CMS to version 9.5.3 or later to address the stored XSS vulnerability in the Address attribute's country-less text formatter.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81898. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart