CVE-2026-81896: Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Label
Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard Form Submissions report (concrete/singlepages/dashboard/reports/forms/legacy.php). a rogue editor could store markup or script in a label that then executes in the browser of any administrator who opens the submissions report for the affected form, producing stored cross-site scripting in the Dashboard. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 8.4 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
concrete/cmsto a version that resolves this vulnerability.Fixed in 9.5.3 - Compensating control
Restrict access to the Concrete CMS Dashboard Form Submissions report (and the underlying form submissions report pages) so that only trusted administrators can view submissions for affected forms, mitigating the impact of stored XSS triggered when an admin opens the report.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs editor-level access sufficient to create or modify a Form block question label. They can place markup or script in the label, which is later rendered in the Dashboard report.
Which users are exposed to the stored script?
Administrators who open the Dashboard Form Submissions report for the affected form are exposed. The issue occurs when the user-defined question label is rendered as a column header in that report.
What versions are affected?
Concrete CMS versions before 9.5.3 are affected. Version 9.5.3 is identified in the provided release notes reference.
What can be done if upgrading is not immediately possible?
Restrict editor access to trusted users and review Form block question labels for markup or script content. Avoid opening submissions reports for forms with untrusted or suspicious labels until the labels have been corrected.