CVE-2026-68534: Concrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in association selectors
Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. An unauthenticated attacker could submit a payload through a public Express Form; it then executed in an administrator's dashboard session when the associated entry was viewed, or in the browser of any visitor to a page using an Express Entry List block with association columns, allowing actions to be performed with that user's privileges. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks v01demort for reporting.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and what interaction is required?
An unauthenticated attacker can submit a malicious label through a public Express Form. The payload executes only when an administrator views the associated entry in the dashboard or when someone visits a page containing an Express Entry List block configured with association columns.
Which users are exposed to the stored payload?
Administrators are exposed when viewing the associated entry in their dashboard session. Visitors are also exposed if they load a page that uses an Express Entry List block with association columns.
What can an attacker do after the script runs?
The script can perform actions using the privileges of the affected administrator or visitor. The described impact includes loss of confidentiality and integrity, but not availability.
What version resolves the issue?
The issue affected Concrete CMS releases before 9.5.3. Updating to 9.5.3 or later addresses the vulnerable raw-HTML rendering behavior.