CVE-2026-18117 Overview
CVE-2026-18117 is a stored cross-site scripting (XSS) vulnerability in Concrete CMS versions 9.0.0 through 9.5.3. The flaw exists in the Edit Alias dialog, which processes the customAliasName value with only a trim() call and no output neutralization. An authenticated editor with canWrite permission on a page can store a malicious alias name. The payload later renders unescaped in the administrative Sitemap panel and executes in any administrator or editor session that opens the panel. This behavior enables session-riding privilege escalation from editor to administrator. The issue is classified under CWE-79.
Critical Impact
An editor-level account can escalate to administrator by hijacking an admin's active Sitemap session through stored JavaScript executed in the browser context.
Affected Products
- Concrete CMS 9.0.0 through 9.5.3
- Sitemap administrative panel (rendering component)
- Edit Alias dialog (customAliasName input handler)
Discovery Timeline
- Vulnerability reported by Nguyen Manh Thuan to the Concrete CMS security team
- 2026-09-14 - CVE-2026-18117 published to NVD
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-18117
Vulnerability Analysis
The vulnerability is a stored XSS in the custom page alias workflow of Concrete CMS. When an editor submits a value through the Edit Alias dialog, the application applies trim() to the customAliasName field and stores the result without sanitization or encoding. The stored value is later rendered into the administrative Sitemap panel without HTML escaping. Any administrator or editor who opens the Sitemap triggers execution of attacker-controlled JavaScript inside their authenticated session. Because the executing context belongs to a higher-privileged victim, the attacker can perform administrator actions such as creating accounts, changing roles, or modifying site content. This turns a page-level write permission into full administrative compromise.
Root Cause
The root cause is missing input neutralization and missing output encoding for the customAliasName field. The server treats the alias value as trusted display text and inserts it into HTML rendered by the Sitemap panel. There is no HTML entity encoding at output time and no allowlist validation at input time.
Attack Vector
Exploitation requires an authenticated account with canWrite permission on at least one page and requires a victim with editor or administrator privileges to open the Sitemap panel. The attacker opens the Edit Alias dialog on a controlled page, submits a customAliasName containing an HTML or JavaScript payload, and waits for a higher-privileged user to load the Sitemap. The payload executes in the victim's browser session and inherits their permissions.
No verified public exploit code is available. See the ConcreteCMS 9.5.3 Release Notes for the vendor's technical description of the fix.
Detection Methods for CVE-2026-18117
Indicators of Compromise
- Alias records in the Concrete CMS database containing HTML tags, <script> markers, or event handler attributes such as onerror= or onload= in the customAliasName field
- Unexpected administrator account creations, permission changes, or role assignments shortly after an editor edited a page alias
- Outbound requests from administrator browser sessions to unfamiliar domains immediately after loading the Sitemap panel
Detection Strategies
- Query the alias storage table for values containing angle brackets, quote characters, or JavaScript URI schemes
- Correlate audit logs of alias edits by editor-tier accounts with subsequent privilege changes performed by administrator accounts
- Enable a Content Security Policy in report-only mode to surface inline script execution originating from CMS admin pages
Monitoring Recommendations
- Monitor Concrete CMS application logs for edits to page aliases performed by non-administrator accounts
- Alert on administrator role assignments, user creations, and permission grants that occur within a short window after Sitemap access
- Capture browser console errors and CSP violation reports from admin users interacting with the Sitemap panel
How to Mitigate CVE-2026-18117
Immediate Actions Required
- Upgrade Concrete CMS to version 9.5.4 or later, which contains the fix referenced in the vendor release notes
- Audit existing page alias records for stored HTML or JavaScript content and remove any suspicious entries
- Review recent administrator role changes and account creations for signs of prior exploitation
Patch Information
Concrete CMS addressed this issue in the 9.5.x line. Details are documented in the ConcreteCMS 9.5.3 Release Notes. Administrators running any 9.0.0 through 9.5.3 build should apply the vendor-supplied update.
Workarounds
- Restrict canWrite page permissions to trusted users until the patch is applied
- Temporarily disable use of custom page aliases in editorial workflows
- Deploy a strict Content Security Policy that forbids inline script execution within the administrative interface
# Configuration example: verify installed Concrete CMS version before and after upgrade
grep -R "APP_VERSION" /path/to/concrete/config/concrete.php
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.