CVE-2026-81925: Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format
Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to the conversation view endpoint. Exploitation was aided by the absence of a CSRF token on the endpoint, which allowed the payload to be delivered through an auto-submitting cross-origin POST without authentication. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Concrete CMS installations running versions before 9.5.3 are affected. Exploitation requires a user to be tricked into submitting a crafted POST request to the conversation view endpoint.
Does an attacker need to be authenticated?
The crafted request can be delivered without authentication because the affected endpoint lacks a CSRF token. However, the supplied CVSS vector indicates low privileges are required for the vulnerability's exploitation conditions.
What impact can successful exploitation have?
A successful attack can execute arbitrary JavaScript in the browser of the user who submits the crafted request. The reported CVSS v4.0 vector indicates low impact to confidentiality and integrity, with no availability impact.