CVE-2026-81899: Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via group folder name on the Members > Groups dashboard
Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members > Groups dashboard page, resulting in stored cross-site scripting. The add and edit group-folder handlers stored the submitted folder name without neutralizing HTML, and the group search grid returned it without output encoding, so the Groups dashboard rendered the name as live markup. An authenticated user holding the Add Group Folder permission could store a script payload as a folder name that executed in the session of any administrator who viewed the Groups dashboard, enabling session and token theft and any action available in the administrator's context. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Lý Chấn Hưng (hunglyvn) for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 9.5.2 - Configuration
Ensure group folder names are output-encoded on the Members > Groups dashboard page so submitted folder names are rendered as plain text (not live markup).
Members > Groups dashboard output encoding/escaping for group folder names = escape/unescape (render as text, not HTML) - Configuration
Modify the add and edit group-folder handlers to neutralize submitted folder names (do not store/accept raw HTML that could execute when rendered on the Groups dashboard).
add/edit group-folder handlers HTML neutralization for submitted folder name = neutralize/validate to prevent HTML/script execution
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with the Add Group Folder permission can exploit it by creating or editing a group folder name containing script content. Exploitation succeeds when an administrator views the Members > Groups dashboard.
Which deployments are affected?
Concrete CMS versions 9.0.0 through 9.5.2 are affected. The vulnerable behavior is in the Members > Groups dashboard handling and display of group folder names.
What is the impact if an administrator triggers the payload?
The script executes in the administrator's browser session. This can enable theft of session data or tokens and actions using the administrator's available privileges.
How can I check for possible exploitation?
Review existing group folder names for HTML or script-like content, especially names created by accounts with the Add Group Folder permission. Any such name may execute when displayed on the Groups dashboard.