CVE-2026-81897: Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via Express form Text control save_control
In Concrete CMS below CMS 9.5.3, the savecontrol action in the Express entities forms dashboard controller did not validate the anti-CSRF token. By causing an authenticated administrator to submit a forged cross-site request, a remote attacker without credentials could write attacker-controlled headline and body values to an existing Express form Text control. Those values were emitted without output encoding by the Express form Text element, so the injected markup executed as persistent JavaScript for any administrator who later opened the affected entry, resulting in stored cross-site scripting. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.7 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 9.5.3
Event History
Frequently Asked Questions
Who can exploit this vulnerability, and what interaction is required?
An unauthenticated remote attacker can exploit it by causing an authenticated Concrete CMS administrator to submit a forged cross-site request. Exploitation requires that administrator interaction, and the attacker does not need credentials.
What is the impact after a successful exploit?
The attacker can alter the headline and body of an existing Express form Text control with malicious markup. The markup persists and executes as JavaScript when an administrator later opens the affected entry.
Which installations are affected?
Concrete CMS versions below 9.5.3 are affected. The issue is in the Express entities forms dashboard controller save_control action and concerns Express form Text controls.
How can an administrator identify a potentially compromised entry?
Review existing Express form Text controls, particularly their headline and body values, for unexpected or suspicious markup. Affected values may execute when an administrator opens the corresponding entry.