CVE-2026-18119: Concrete CMS Stored XSS Vulnerability

CVE-2026-18119 Overview

CVE-2026-18119 is a stored cross-site scripting (XSS) vulnerability affecting Concrete CMS versions below 9.5.3. The flaw resides in the Block Design dialog, which fails to sanitize custom style values before writing them into page CSS through a DOM sink. An authenticated editor-level user can inject malicious script that executes in the browser session of an administrator viewing the affected page. Successful exploitation enables privilege escalation from editor to administrator. The Concrete CMS security team assigned this issue a CVSS v4.0 score of 7.0. The weakness is classified under CWE-79, Improper Neutralization of Input During Web Page Generation.

Critical Impact

An authenticated editor can execute arbitrary JavaScript in an administrator's session, leading to full account takeover and site compromise.

Affected Products

• Concrete CMS versions prior to 9.5.3
• Concrete CMS Block Design dialog component
• Sites permitting editor-level user accounts on vulnerable versions

Discovery Timeline

• 2026-09-14 - CVE-2026-18119 published to the National Vulnerability Database
• 2026-09-18 - Last updated in NVD database
• Reporter - Nguyen Manh Thuan credited by Concrete CMS for reporting the issue

Technical Details for CVE-2026-18119

Vulnerability Analysis

The vulnerability exists in the Block Design dialog of Concrete CMS. Editors use this dialog to apply custom style values, including CSS properties, to blocks on a page. The affected code path writes user-supplied style values directly into page CSS through a DOM sink without applying sanitization or output encoding.

Because the values are injected into a CSS context reflected in the rendered page, an attacker can craft input that breaks out of the intended CSS declaration and introduces attacker-controlled markup or script content. The stored nature of the flaw means the payload persists on any page carrying the malicious block. When an administrator later views that page, the script executes with the administrator's privileges. This yields horizontal-to-vertical privilege escalation, allowing the editor to perform any action available to the administrator role, including creating new users, modifying site configuration, or installing malicious add-ons.

Root Cause

The root cause is missing input sanitization and unsafe use of a DOM sink when persisting Block Design style values. The application trusts editor-supplied style content and writes it into page CSS without neutralizing script-relevant characters or enforcing an allowlist of valid CSS properties and values, matching the [CWE-79] pattern.

Attack Vector

Exploitation requires an authenticated account with editor-level permissions and interaction from a higher-privileged user who subsequently loads the affected page. The attacker submits a malicious custom style value through the Block Design dialog, saves the block, and waits for an administrator to view the page. The payload then executes in the administrator's browser session, permitting session token theft, forced administrative actions, or backend privilege escalation.

No verified public exploit code is available for this vulnerability. See the ConcreteCMS Version 9.5.3 Release Notes for vendor technical details.

Detection Methods for CVE-2026-18119

Indicators of Compromise

• Unexpected <script>, expression(), or javascript: sequences stored within Block Design style attributes or serialized block records in the database.
• Administrator sessions performing configuration changes shortly after visiting editor-authored pages, particularly user role modifications or add-on installations.
• Newly created administrator accounts or elevated permissions granted without a corresponding change-management record.

Detection Strategies

• Audit the Concrete CMS block storage tables for stored style values containing HTML tags, event handlers, or CSS expression payloads.
• Review web server access logs for repeated POST requests to Block Design edit endpoints originating from editor accounts.
• Correlate editor account activity with subsequent administrator-only actions performed from the same client fingerprint.

Monitoring Recommendations

• Enable and forward Concrete CMS application logs and user activity logs to a centralized SIEM for correlation.
• Monitor for privilege changes, add-on installations, and file uploads performed within short windows after editor content edits.
• Alert on Content Security Policy (CSP) violation reports that reference inline script execution on CMS-rendered pages.

How to Mitigate CVE-2026-18119

Immediate Actions Required

• Upgrade Concrete CMS to version 9.5.3 or later on all production and staging environments.
• Review the editor-role user list and remove or downgrade accounts that no longer require content-authoring privileges.
• Audit existing pages and blocks for suspicious custom style values and remove any injected payloads before administrators revisit affected content.

Patch Information

Concrete CMS addressed the flaw in version 9.5.3 by sanitizing custom style values in the Block Design dialog before they are written to page CSS. Refer to the ConcreteCMS Version 9.5.3 Release Notes for the full changelog and upgrade instructions.

Workarounds

• Temporarily restrict access to the Block Design dialog by limiting editor permissions until the patch is applied.
• Deploy a strict Content Security Policy that disallows inline scripts and unsafe-inline styles to reduce the impact of stored XSS payloads.
• Require administrators to review editor-authored content in a low-privilege browser profile that is not authenticated to the CMS.

# Example strict Content-Security-Policy header for Concrete CMS deployments
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"