CVE-2026-81927: Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode
Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode (concrete.filemanager.images.svgsanitization.action = reject), uploaded SVGs were checked only against a small built-in blocklist covering the script element and on event-handler attributes; the broader enshrined/svg-sanitize pass still ran, but its result was discarded, so vectors it would have stripped, such as a javascript: URI in an xlink:href, were stored unmodified and executed when the file was opened directly. A user able to upload files could thereby run arbitrary JavaScript in the browser of any user who viewed the file. The default sanitize mode was not affected. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 1.8 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Oriol Ortiz for reporting.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Only deployments running a version before 9.5.3 with SVG sanitization configured to the non-default "Reject files containing potentially harmful elements" mode are affected. The default sanitize mode was not affected.
What access and user interaction are required for exploitation?
An attacker must be able to upload an SVG file. Exploitation also requires a user to open the uploaded SVG directly, at which point the attacker-controlled JavaScript can execute in that user's browser.
How can I determine whether my site is exposed?
Check whether the Concrete CMS version is earlier than 9.5.3 and whether concrete.file_manager.images.svg_sanitization.action is set to reject. Both conditions must be present for the described issue to apply.
What can be done if upgrading is not immediately possible?
Switch SVG processing away from the affected reject mode to the default sanitize mode. Restricting SVG upload capability also reduces exposure because exploitation requires an attacker to upload a crafted SVG.