CVE-2026-81900

Received Received - Intake

Stored XSS in Concrete CMS via YouTube Block Attributes

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: ConcreteCMS

Description

Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML attributes without escaping or integer casting, resulting in stored cross-site scripting. A user with edit_block permission could inject an event handler that executed script for visitors rendering the page, acting with administrative privileges where the victim was an administrator. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks sh4d0byss for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-81900

EUVD

EUVD-2026-78205

Affected Vendors & Products

Vendor	Product	Version / Range
concrete_cms	concrete_cms	to 9.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Concrete CMS before 9.5.3 had a stored cross-site scripting (XSS) vulnerability in its YouTube block. The system only applied the trim() function to stored width and height values before embedding them in iframe HTML attributes without proper escaping or type conversion. This allowed users with edit_block permission to inject malicious event handlers that executed scripts when the page was viewed, even with administrative privileges.

Detection Guidance

This vulnerability is specific to Concrete CMS versions before 9.5.3 and involves stored cross-site scripting in YouTube block attributes. To detect it, inspect Concrete CMS installations for versions below 9.5.3 and review YouTube block configurations for suspicious event handlers or script injections in width/height attributes.

Impact Analysis

An attacker with edit_block permission could inject scripts that steal session cookies, perform actions on behalf of administrators, or redirect users to malicious sites. Visitors to compromised pages, especially administrators, could have their accounts hijacked or sensitive data exposed.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's integrity and confidentiality principles. For HIPAA, it may expose protected health information, risking compliance with safeguards for ePHI. Both regulations require protection against unauthorized data access or modification.

Mitigation Strategies

Upgrade Concrete CMS to version 9.5.3 or later immediately. Remove any untrusted user permissions for edit_block until the update is applied. Review and sanitize existing YouTube block configurations for malicious scripts.

Hi! I’m here to help you understand CVE-2026-81900. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70