CVE-2026-81894: Concrete CMS 9.5.2 and below is vulnerable to Stored DOM-based Cross-site Scripting (XSS) in the Gallery block image Caption field
Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting (XSS) via the Gallery block's per-image Caption field because the bundled Magnific Popup lightbox script (concrete/js/features/imagery/frontend.js) re-parses the attribute-decoded caption as HTML through jQuery's .append() in titleSrc instead of inserting it as text. A user with permission to edit a page containing a Gallery block can store a caption that executes in the browser of any visitor who opens that image's lightbox. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.5 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the payload?
An attacker needs permission to edit a page that contains a Gallery block and must be able to set a per-image Caption. Any visitor who opens the affected image in the Gallery lightbox can trigger the stored script in their browser.
Does exploitation require visitor interaction?
Yes. The stored caption executes when a visitor opens the relevant image's lightbox; merely viewing the page is not described as sufficient.
Which component processes the malicious caption?
The bundled Magnific Popup lightbox script in concrete/js/features/imagery/frontend.js attribute-decodes the caption and re-parses it as HTML through jQuery's .append() in titleSrc.