CVE-2026-81917: Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags
Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block with the description or tags column enabled, including unauthenticated visitors. Successful exploitation could allow theft of session data or actions performed in the visitor's context. The block controller returned the description and tags values without the h() escaping already applied to the title column, and the block view template wrote the returned value directly into the results table The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N. Thanks Nguyen Manh Thuan for reporting.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the malicious script?
An attacker needs permission to edit file properties in Concrete CMS to store a payload in a file description or tags. Any visitor to a page that displays the affected Document Library block with the description or tags column enabled can execute the payload, including unauthenticated visitors.
What configuration is required for exploitation?
The affected page must use a Document Library block and have either the description column or tags column enabled. The title column is not described as affected because it already uses HTML escaping.
How can I determine whether an installation is affected?
Installations below Concrete CMS 9.5.3 are affected. Review Document Library blocks for enabled description or tags columns and inspect file property values for unexpected script-like content.
What should be done if upgrading cannot happen immediately?
Disable the description and tags columns on Document Library blocks where possible, and restrict permission to edit file properties to trusted users. Review existing file descriptions and tags and remove untrusted or suspicious values.