CVE-2026-81910: Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values
Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer (color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and ImageStyle) are interpolated into server-compiled LESS source without neutralization of LESS syntax, allowing a user with the Theme Customization permission to inject arbitrary LESS directives. By injecting the @import (inline) directive, an attacker can read arbitrary files on the server and reach internal network resources through PHP stream wrappers. The compiled output, including any disclosed file contents, is written to the site's publicly served CSS cache, exposing database credentials, private keys, and other application secrets, and enabling server-side request forgery. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.9 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the Theme Customization permission. The CVSS vector indicates network access, low attack complexity, no user interaction, and high privileges required.
What can an attacker do after exploiting it?
They can inject LESS directives through customizer style values, including @import (inline), to read arbitrary server files and access internal network resources through PHP stream wrappers. Disclosed content can be written into publicly served cached CSS, potentially exposing database credentials, private keys, and other secrets.
Which installations are affected?
Concrete CMS version 9 through 9.5.2 is identified as affected. The issue is in Theme Customizer handling of color channels and other style properties processed by ColorStyle and related classes, including FontFamilyStyle and ImageStyle.
How could defenders identify possible exposure?
Review Theme Customizer submissions and generated CSS cache files for unexpected LESS directives, particularly @import (inline), or CSS output containing sensitive file content. Also investigate whether accounts with Theme Customization permission made unusual style changes.