CVE-2026-81918: Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block
Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with editpagecontents permissions could store a payload which executes in the browser of any visitor who viewed a page where the block was configured to display a date-type attribute. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Oriol Ortiz for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 9.5.3
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the stored payload?
An attacker needs edit_page_contents permissions to configure the Page Attribute Display block and save a malicious Date Format value. Any visitor who views a page where that block displays a date-type attribute may execute the payload in their browser.
What configuration is required for exploitation?
The affected Page Attribute Display block must be configured to display a date-type attribute, and its Date Format field must contain the stored payload. The provided information does not establish that default configurations are affected.
How can administrators identify potentially affected pages?
Review Page Attribute Display blocks on sites running versions below 9.5.3, focusing on blocks configured to display date-type attributes. Inspect their Date Format field for unexpected or untrusted content.
What can be done before upgrading?
Restrict edit_page_contents permissions to trusted users and review or remove untrusted Date Format values from affected blocks. Upgrading to 9.5.3 or later addresses the affected version range described.