CVE-2026-81913: Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter.
Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain that sends a user to an arbitrary external site immediately after authentication, facilitating phishing and credential theft. The same handling is present in the registration flow, giving a second entry point on sites with registration enabled. Concrete CMS versions prior to 9.5.0 do not include the rcURL parameter or this allowlist and are not affected. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Michal M. for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 9.5.2 - Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 9.5.0 - Configuration
Fix Open Redirect by ensuring the rcURL parameter is validated against the intended allowlist so links on the site's own domain cannot redirect authenticated users to arbitrary external sites immediately after authentication (and similarly in the registration flow when registration is enabled).
Concrete CMS rcURL allowlist/validation = restrict rcURL to approved destinations (remove arbitrary redirect behavior)
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites running Concrete CMS 9.5.0 through 9.5.2 are affected. Versions earlier than 9.5.0 do not include the rcURL parameter or its allowlist and are not affected.
What does an attacker need to exploit it?
An attacker needs to convince a user to follow a crafted link on the affected site's own domain. No attacker authentication is required, but the user must interact with the link and authenticate before the redirect occurs.
Are there multiple affected user flows?
Yes. The redirect can occur after authentication, and the same rcURL handling is also present in the registration flow when site registration is enabled.