CVE-2026-81899
Received Received - Intake

Stored XSS in Concrete CMS Group Folders

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: ConcreteCMS

Description
Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members > Groups dashboard page, resulting in stored cross-site scripting. The add and edit group-folder handlers stored the submitted folder name without neutralizing HTML, and the group search grid returned it without output encoding, so the Groups dashboard rendered the name as live markup. An authenticated user holding the Add Group Folder permission could store a script payload as a folder name that executed in the session of any administrator who viewed the Groups dashboard, enabling session and token theft and any action available in the administrator's context.Β The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks LΓ½ ChαΊ₯n HΖ°ng (hunglyvn) for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-81899
EUVD
EUVD-2026-79127

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
concrete_cms concrete_cms From 9.0.0 (inc) to 9.5.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Concrete CMS versions 9.0.0 to 9.5.2 stored group folder names without sanitization and displayed them unescaped on the Groups dashboard. This allowed an authenticated user with Add Group Folder permission to inject a script payload as a folder name. When an administrator viewed the dashboard, the script executed in their session, enabling theft of session tokens and performing actions in the admin context.

Detection Guidance

Check Concrete CMS versions between 9.0.0 and 9.5.2. Inspect group folder names in the Members > Groups dashboard for any unescaped HTML or script content. Review stored folder names in the database for unsanitized inputs.

Impact Analysis

An attacker could steal your session tokens or cookies, gain unauthorized access to your account, and perform actions as an administrator. This includes modifying site content, accessing sensitive data, or taking control of the entire CMS.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access control. It may result in data breaches, non-compliance penalties, and loss of trust.

Mitigation Strategies

Upgrade Concrete CMS to a version beyond 9.5.2. Remove or sanitize any suspicious group folder names. Apply output encoding for all user-supplied data displayed in the Groups dashboard. Restrict Add Group Folder permission to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81899. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart