CVE-2026-18116: Concrete CMS Stored XSS Vulnerability

CVE-2026-18116 Overview

CVE-2026-18116 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in Concrete CMS versions 8.3.0 through 9.5.2. The flaw resides in the dashboard Waiting For Me block, which renders calendar event names without HTML escaping in workflow approval and deletion notifications. A registered user with permission to add events to a calendar governed by an approval workflow can submit an event name containing a script payload. The payload executes in an administrator's browser when the pending workflow request is displayed, and can be leveraged to create a new administrator account.

Critical Impact
Authenticated low-privilege users can escalate to administrator by injecting script into calendar event names that execute in an approver's session.

Affected Products

Concrete CMS 8.3.0 through 8.5.x
Concrete CMS 9.0.0 through 9.5.2
Dashboard Waiting For Me workflow notification block

Discovery Timeline

2026-09-14 - CVE-2026-18116 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-18116

Vulnerability Analysis

The vulnerability is a stored XSS issue affecting the workflow notification pipeline in Concrete CMS. When a calendar is protected by an approval workflow, event submissions are queued for administrator review. The event name is persisted to the database without input sanitization. When an administrator opens the dashboard, the Waiting For Me block renders the pending request and outputs the event name into the HTML response without escaping. This causes attacker-controlled markup to execute in the administrator's authenticated session.

Because the execution context is a privileged dashboard session, an attacker can issue authenticated administrative requests through the browser. The advisory notes that the payload can create a new administrator account, giving the attacker persistent control over the CMS.

Root Cause

The root cause is missing output encoding in the workflow notification templates combined with absent server-side sanitization of the calendar event name field. Both the approval and deletion notification views render the untrusted name verbatim.

Attack Vector

Exploitation requires an authenticated account that holds the calendar event creation permission on a calendar governed by an approval workflow. The attacker submits an event whose name contains a script payload. The payload is stored and later delivered to any administrator who opens the Waiting For Me dashboard block. User interaction from the administrator is required to trigger execution. No verified public proof-of-concept is available for CVE-2026-18116 at the time of publication. See the Concrete CMS Release Notes for vendor technical details.

Detection Methods for CVE-2026-18116

Indicators of Compromise

Calendar event names containing HTML tags such as <script>, <img onerror=, or <svg onload= in the CalendarEvents or workflow request tables.
Creation of new administrator accounts shortly after an administrator viewed the dashboard.
Unexpected workflow entries submitted by low-privilege registered users.
Outbound requests from administrator browser sessions to unknown domains referenced by injected payloads.

Detection Strategies

Query the Concrete CMS database for pending or historical workflow requests where the event name field contains angle brackets or common XSS keywords.
Review web server access logs for POST requests to calendar event creation endpoints followed by administrative account creation requests.
Audit the user table for new users granted the administrator group between the vulnerability publication date and patch deployment.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting in the dashboard to surface inline script execution attempts.
Alert on administrator group membership changes and new privileged account creation events.
Monitor workflow submission volume and content from non-administrative accounts.

How to Mitigate CVE-2026-18116

Immediate Actions Required

Upgrade Concrete CMS to version 9.5.3 or later as documented in the vendor release notes.
Audit all administrator accounts and remove any that were not created by legitimate administrators.
Review pending workflow requests and purge any entries containing script content before an administrator opens the dashboard.
Temporarily restrict which user groups can submit events to calendars governed by approval workflows.

Patch Information

Concrete CMS addressed CVE-2026-18116 in the 9.5.3 release. Details are published in the Concrete CMS 9.5.3 Release Notes. Administrators running the 8.x branch should follow the vendor's guidance for upgrading to a supported patched version.

Workarounds

Revoke the calendar event creation permission from untrusted user groups until the patch is applied.
Disable approval workflows on calendars accessible to non-administrative users.
Deploy a Web Application Firewall (WAF) rule that blocks calendar event submissions containing HTML tags or JavaScript event handlers.

bash

# Example WAF pattern to block script payloads in calendar event names
# ModSecurity rule (illustrative)
SecRule ARGS:name "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1026018116,phase:2,deny,status:403,\
     msg:'CVE-2026-18116 Concrete CMS calendar event XSS attempt'"