CVE-2026-18113 Overview
CVE-2026-18113 is a stored cross-site scripting (XSS) vulnerability in Concrete CMS versions 9.0 through 9.5.2. The Top Navigation Bar block fails to HTML-escape dropdown child page names before rendering them in the page. A user with permission to create or rename pages can inject a script payload through a child page name. That payload executes in the browser of any visitor, editor, or administrator who views the navigation and opens the affected dropdown. The script runs with the victim's privileges in the Concrete CMS origin and can read same-origin content or perform actions available to that user. Concrete CMS credits labixiaoxin97 for reporting the issue.
Critical Impact
An authenticated low-privilege author can hijack administrator sessions and execute arbitrary actions within the Concrete CMS origin by planting a malicious page name.
Affected Products
- Concrete CMS 9.0 through 9.5.2
- Sites using the Top Navigation Bar block with dropdown child pages
- Concrete CMS deployments that allow non-administrative users to create or rename pages
Discovery Timeline
- 2026-09-15 - CVE-2026-18113 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in the NVD database
Technical Details for CVE-2026-18113
Vulnerability Analysis
The flaw is a classic stored cross-site scripting (XSS) issue tracked under [CWE-79]. The Top Navigation Bar block reads child page names from the page hierarchy and writes them directly into the rendered HTML output for dropdown menus. Because the block skips HTML entity encoding, any markup contained in a page name is interpreted by the browser as part of the document rather than as text.
Exploitation requires an authenticated account with permission to create or rename pages. The attack succeeds automatically whenever another user, including an administrator, loads a page containing the navigation block and expands the dropdown. Because the payload executes within the trusted origin, it can read cookies not marked HttpOnly, exfiltrate CSRF tokens, call authenticated backend endpoints, or modify site content on behalf of the victim.
Root Cause
The root cause is missing output encoding in the Top Navigation Bar block template. Child page names are treated as safe text and inserted into HTML without invoking a function such as h() or htmlspecialchars(). Concrete CMS resolved the issue in the 9.5.3 release, as documented in the ConcreteCMS Version 9.5 Release Notes.
Attack Vector
The attack vector is network-based and requires high privileges relative to page management, but no user interaction beyond opening the affected navigation dropdown. A malicious editor creates or renames a child page so that its name contains a script payload. The payload is stored in the page repository and served to every visitor who renders the parent navigation block. See the vendor release notes referenced above for technical remediation details; no verified proof-of-concept code is published for this issue.
Detection Methods for CVE-2026-18113
Indicators of Compromise
- Page names in the Concrete CMS site tree that contain angle brackets, <script> fragments, onerror=, onload=, or javascript: sequences
- Unexpected outbound requests from browser sessions immediately after loading pages containing the Top Navigation Bar block
- Audit log entries showing page create or rename events performed by non-administrative accounts prior to unexplained administrator activity
Detection Strategies
- Query the Concrete CMS database for Pages.cName values that contain HTML metacharacters such as <, >, or quotation marks
- Inspect rendered navigation HTML in staging environments to confirm dropdown items are HTML-encoded
- Correlate page rename events with subsequent administrator session anomalies, such as new user creation or permission changes
Monitoring Recommendations
- Enable and centralize Concrete CMS audit logs for page create, rename, and permission-change events
- Monitor web server access logs for outbound requests originating from administrative pages that contain the navigation block
- Alert on Content Security Policy (CSP) violation reports referencing inline script execution within CMS pages
How to Mitigate CVE-2026-18113
Immediate Actions Required
- Upgrade Concrete CMS to version 9.5.3 or later, which addresses the missing output encoding
- Audit existing page names for embedded HTML or script content and sanitize any offending entries
- Review accounts with page creation or rename permissions and revoke access for users that do not require it
Patch Information
Concrete CMS released the fix in the 9.5.3 update. Details are published in the ConcreteCMS Version 9.5 Release Notes. Administrators running any version from 9.0 through 9.5.2 should apply the update.
Workarounds
- Restrict page create and rename permissions to trusted administrators until the patch is deployed
- Replace the Top Navigation Bar block with an alternative navigation block that HTML-encodes page titles
- Deploy a Content Security Policy (CSP) that disallows inline scripts to reduce the impact of stored XSS payloads
# Example Content-Security-Policy header to limit inline script execution
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
