CVE-2026-81894: Concrete CMS Gallery Block XSS Vulnerability

CVE-2026-81894 Overview

CVE-2026-81894 is a stored DOM-based Cross-Site Scripting (XSS) vulnerability in Concrete CMS 9.5.2 and earlier. The flaw resides in the Gallery block's per-image Caption field. The bundled Magnific Popup lightbox script at concrete/js/features/imagery/frontend.js re-parses the attribute-decoded caption as HTML via jQuery's .append() inside titleSrc, rather than inserting the value as text. An authenticated user with permission to edit a page containing a Gallery block can store a caption that executes JavaScript in the browser of any visitor who opens the affected image's lightbox.

Critical Impact
Stored XSS payloads execute in every visitor's browser session, enabling session hijacking, credential theft, and administrative account takeover.

Affected Products

Concrete CMS 9.0.0 through 9.5.2
Concrete CMS Gallery block feature
Bundled Magnific Popup lightbox component (concrete/js/features/imagery/frontend.js)

Discovery Timeline

Vulnerability reported by Yonatan Drori (Tenzai) to the Concrete CMS security team
2026-09-15 - CVE-2026-81894 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-81894

Vulnerability Analysis

The vulnerability is a stored DOM-based XSS affecting the Gallery block's per-image Caption field. Caption values are persisted to the database and rendered into an HTML attribute on the page. When a visitor clicks an image, the Magnific Popup lightbox extracts the caption from the attribute and passes it through the titleSrc handler. That handler uses jQuery's .append() method, which parses the string as HTML rather than escaping it as text content.

Because attribute decoding occurs before HTML parsing, an attacker-controlled caption containing markup executes in the DOM of every page visitor. The attack requires no interaction beyond opening the image lightbox, which is normal user behavior on any gallery page.

Root Cause

The root cause is unsafe DOM insertion in the client-side lightbox script. The titleSrc function in concrete/js/features/imagery/frontend.js uses .append() on caption data instead of .text(). jQuery's .append() interprets angle brackets and script-loading constructs as live HTML, producing DOM-based XSS classified under [CWE-79] (mapped in the record as [CWE-89] Improper Neutralization).

Attack Vector

An authenticated editor with permission to modify a page containing a Gallery block sets a malicious Caption on any image. The payload is stored server-side and served to all subsequent visitors. When a visitor opens the lightbox for that image, the payload executes in the browser under the site's origin. Attackers can steal session cookies, perform actions on behalf of administrators, or pivot to further attacks against the CMS backend.

No verified public exploit code is available. See the Concrete CMS 9.5 Release Notes for vendor technical details.

Detection Methods for CVE-2026-81894

Indicators of Compromise

Gallery block caption fields containing HTML tags such as <script>, <img onerror=>, or <svg onload=>
Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading gallery pages
Unusual administrative actions originating from editor or admin sessions that correlate with gallery page views

Detection Strategies

Query the Concrete CMS database for Gallery block caption columns containing angle brackets, javascript: URIs, or event handler attributes
Deploy Content Security Policy (CSP) reporting to capture script-src violations triggered by injected payloads
Review web server access logs for POST requests to page edit endpoints that update Gallery block content

Monitoring Recommendations

Monitor editor and administrator account activity for unauthorized page or block modifications
Alert on browser-side JavaScript errors and CSP violations originating from gallery lightbox interactions
Audit user permissions to ensure only trusted accounts hold page-edit rights on Gallery-enabled pages

How to Mitigate CVE-2026-81894

Immediate Actions Required

Upgrade Concrete CMS to version 9.5.3 or later, which addresses the unsafe titleSrc handling
Audit all existing Gallery block captions for HTML content and remove any suspicious entries
Restrict page-edit permissions to the minimum set of trusted users until patching is complete

Patch Information

Concrete CMS resolved this issue in version 9.5.3. The fix updates concrete/js/features/imagery/frontend.js so that caption content is inserted as text rather than parsed as HTML. Refer to the Concrete CMS 9.5.3 Release Notes for full patch details and upgrade instructions.

Workarounds

Disable the Gallery block on public-facing pages until the patch is applied
Enforce a strict Content Security Policy that blocks inline scripts and restricts script sources to trusted origins
Temporarily revoke page-edit permissions from non-administrative accounts to limit who can inject captions

bash

# Example strict CSP header to mitigate DOM-based XSS execution
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'