CVE-2026-8353: Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in atomik theme
Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in the Atomik theme. A rogue editor can inject arbitrary JavaScript that executes in the context of any authenticated user visiting the affected account pages. This can lead to session hijacking, credential theft, malicious actions performed on behalf of users, and potential privilege escalation. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8353?
The severity of CVE-2026-8353 is rated as 20.
How do I fix CVE-2026-8353?
To fix CVE-2026-8353, upgrade your Concrete CMS to version 9.5.1 or later.
What types of attacks can CVE-2026-8353 lead to?
CVE-2026-8353 can lead to session hijacking, credential theft, and execution of malicious scripts.
Which versions of Concrete CMS are affected by CVE-2026-8353?
Concrete CMS versions 9.0 to 9.5.0 are affected by CVE-2026-8353.
What is the nature of the vulnerability in CVE-2026-8353?
CVE-2026-8353 is a Stored XSS vulnerability that allows injection of arbitrary JavaScript via page names in the Atomik theme.