CVE-2026-81898: Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address attribute in Express association views
In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user able to submit an Address attribute could execute script in the session of any dashboard user who opened the affected entry. The unescaped branch was reachable because a non-required Address attribute accepted a blank country, and because several Express association templates (for example concrete/elements/express/form/view/dashboard/association.php) echoed the association label mask without applying h(). The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 9.5.3 - Configuration
Update Express association templates that echo the association label mask to apply HTML-escaping using h(), because country-less Address formatter skipped HTML-escaping and templates echoed the mask without applying h().
Express association views (e.g., concrete/elements/express/form/view/dashboard/association.php) HTML escaping for association label mask and country-less Address formatter = Apply HTML-escaping (use h() where templates echo the association label mask) instead of skipping HTML-escaping
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk from the resulting script execution?
An attacker needs permission to submit an Address attribute. The stored script executes when a dashboard user opens the affected Express association entry.
What configuration makes the vulnerable code path reachable?
The Address attribute must be non-required and accept a blank country. In that country-less case, the text formatter did not HTML-escape the association label mask in affected Express association views.
Which versions are affected?
Concrete CMS versions below 9.5.3 are affected. Version 9.5.3 is identified as the release boundary in the available information.
What can be done if upgrading is not immediately possible?
Restrict who can submit Address attributes and avoid allowing blank-country values for non-required Address attributes. Limit dashboard access to reduce exposure to stored payloads being opened.