CVE-2026-81917

Received Received - Intake

Stored Cross-Site Scripting in Concrete CMS Document Library Block

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: ConcreteCMS

Description

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block with the description or tags column enabled, including unauthenticated visitors. Successful exploitation could allow theft of session data or actions performed in the visitor's context. The block controller returned the description and tags values without the h() escaping already applied to the title column, and the block view template wrote the returned value directly into the results table The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N. Thanks Nguyen Manh Thuan for reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-81917

Affected Vendors & Products

Vendor	Product	Version / Range
concrete5	concrete_cms	to 9.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Concrete CMS versions below 9.5.3 have a flaw where HTML output escaping is not applied to the file description and tags fields in the Document Library block. This allows a user with edit permissions to inject a script payload that executes in the browsers of visitors viewing the block, including unauthenticated users. The issue arises because the block controller returns these values without proper escaping, and the template writes them directly into the results table.

Detection Guidance

Check Concrete CMS version with: grep -r '"version"' /path/to/concrete/config/install/ or via admin panel. If version is below 9.5.3, the system is vulnerable. Inspect Document Library block templates for unescaped output in description and tags fields.

Impact Analysis

This vulnerability could allow an attacker to steal session data or perform actions on behalf of visitors to a page displaying the affected block. Since unauthenticated users are also vulnerable, anyone visiting a compromised page could have their browser compromised, leading to potential data theft or unauthorized actions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations using vulnerable versions of Concrete CMS may face compliance violations, legal penalties, and reputational damage if user data is compromised through this flaw.

Mitigation Strategies

Upgrade Concrete CMS to version 9.5.3 or higher immediately. If upgrading is not possible, disable the Document Library block or restrict edit permissions to trusted users only. Review file descriptions and tags for malicious scripts.

Hi! I’m here to help you understand CVE-2026-81917. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70