CVE-2026-18111: Concrete CMS Stored XSS Vulnerability

CVE-2026-18111 Overview

CVE-2026-18111 is a stored cross-site scripting (XSS) vulnerability in Concrete CMS affecting versions 9 before 9.5.3 and versions before 8.5.21. The flaw resides in the Feature, Feature Link, Hero Image, and Image blocks, where the external link URL is insufficiently validated by the link filter and rendered without output escaping. An authenticated user with page-editing permissions can store a crafted external link that breaks out of the link markup and injects arbitrary JavaScript. The Concrete CMS security team assigned this issue a CVSS v4.0 score of 8.5. Credit for the discovery goes to KhanMarshai.

Critical Impact
Injected JavaScript executes in the session of any user who views, previews, or edits the affected page, enabling session hijacking and privilege escalation up to full administrative takeover.

Affected Products

Concrete CMS 9 before 9.5.3 (Feature, Feature Link, Hero Image, and Image blocks)
Concrete CMS before 8.5.21 (Feature and Image blocks)
Sites where non-administrative users hold Add Block and Edit Contents permissions

Discovery Timeline

2026-09-15 - CVE-2026-18111 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-18111

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the block-editing pipeline of Concrete CMS. When a user adds or edits a Feature, Feature Link, Hero Image, or Image block, the external link URL field is passed through a link filter intended to validate and normalize the value. The filter fails to reject payloads that terminate the surrounding HTML attribute context. The stored value is later rendered into anchor markup without proper output escaping, allowing attacker-controlled characters to break out of the attribute and inject scriptable content. Because the payload persists in the block data, it executes for every subsequent viewer, editor, or previewer of the page.

Root Cause

The root cause is inadequate input validation combined with missing output encoding on the external link URL property. The link filter treats the URL as a syntactic string rather than enforcing a strict allow-list of schemes and characters, and the rendering layer emits the stored value directly into the href attribute. This design conflates validation and escaping, so any bypass of the filter results in unescaped output. The underlying weakness maps to injection of untrusted data into an HTML context.

Attack Vector

Exploitation requires an authenticated account with page-editing rights, specifically Add Block combined with Edit Contents on at least one page. The attacker inserts one of the affected block types and supplies a crafted external link URL containing characters that terminate the attribute quoting and introduce an event handler or inline script. Once saved, the block persists the payload in the page data. Any administrator or editor who navigates to the page triggers the script under their session, allowing the attacker to steal session cookies, perform actions on their behalf, or escalate to administrative control. User interaction is required to trigger the payload, which is reflected in the CVSS v4.0 vector.

No verified public exploit code is available. Refer to the ConcreteCMS Version 9.5.3 Release Notes for vendor details.

Detection Methods for CVE-2026-18111

Indicators of Compromise

Block records for Feature, Feature Link, Hero Image, or Image blocks whose external link fields contain characters such as ", >, <, or javascript: schemes
Rendered anchor tags containing event handlers such as onerror, onclick, or onmouseover sourced from block content
Unexpected outbound requests from administrator browsers immediately after loading pages that contain the affected blocks

Detection Strategies

Query the Concrete CMS block content tables for stored URL values that do not begin with http://, https://, mailto:, or a site-relative path
Review web server access logs for editor and administrator sessions that requested pages containing recently modified Feature or Image blocks
Audit page version history for edits made by low-privilege accounts to blocks that expose external link fields

Monitoring Recommendations

Alert on new or modified blocks created by non-administrative users, especially where external link URLs are set
Monitor administrator session cookie use from unfamiliar IP addresses following page-edit events
Log and review changes to page-editing permission grants (Add Block, Edit Contents) on production sites

How to Mitigate CVE-2026-18111

Immediate Actions Required

Upgrade Concrete CMS 9.x installations to version 9.5.3 or later
Upgrade Concrete CMS 8.x installations to version 8.5.21 or later
Audit existing Feature, Feature Link, Hero Image, and Image blocks for suspicious external link values and remove any that contain script content
Rotate administrator session tokens and credentials on sites where suspicious block edits are found

Patch Information

Concrete CMS addressed this vulnerability in versions 9.5.3 and 8.5.21. The fix strengthens the link filter validation and applies proper output escaping when rendering external link URLs in the affected block types. Full remediation details are documented in the ConcreteCMS Version 9.5.3 Release Notes.

Workarounds

Restrict Add Block and Edit Contents permissions on the affected block types to fully trusted users until patches are applied
Temporarily disable the Feature, Feature Link, Hero Image, and Image blocks in the block type list for untrusted editor groups
Enforce a strict Content Security Policy that blocks inline script execution and unapproved event handlers on rendered pages

bash

# Example: enforce a restrictive Content Security Policy at the web server layer
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"