CVE-2026-18113: Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the Top Navigation Bar Block via Dropdown Child Page Names
In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could create or rename pages could store a script through a child page name and have it run in the browser of any visitor, editor, or administrator who viewed the navigation and opened the affected dropdown. In the Concrete CMS origin, the script executed with the victim's privileges and could read same-origin content or perform actions available to that user. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks labixiaoxin97 for reporting.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs privileges to create pages or rename existing pages, because the malicious script is stored in a dropdown child page name. The CVSS vector identifies the required privileges as high.
When is the stored script triggered?
It runs when a visitor, editor, or administrator views navigation containing the affected child page and opens the relevant dropdown. The script executes in the Concrete CMS origin with the privileges of the viewing user.
What is the impact if an administrator triggers the payload?
The script can read same-origin content and perform actions available to that administrator. This can affect confidentiality, integrity, and availability within the Concrete CMS instance.
Which versions are affected?
Concrete CMS versions 9.0 through 9.5.2 are affected.