CVE-2026-81895 Overview
CVE-2026-81895 is a stored, time-based blind SQL injection vulnerability in Concrete CMS versions prior to 9.5.3. The flaw exists in the Document Library block, which accepts file-set identifiers submitted through the fsID[] parameter without validating them as integers. When the block is configured with setMode set to any, each stored identifier is concatenated directly into the file-set filter query rather than cast or bound as a parameter. An authenticated user with permission to add or edit the block can persist SQL syntax in the block configuration (btDocumentLibrary.setIds), and that expression executes every time a page containing the block is rendered.
Critical Impact
Authenticated attackers with editing privileges can persist arbitrary SQL that executes on every page render, exposing full database confidentiality, integrity, and availability [CWE-89].
Affected Products
- Concrete CMS versions prior to 9.5.3
- Document Library block component (btDocumentLibrary)
- Installations exposing block editing rights to authenticated users
Discovery Timeline
- 2026-09-15 - CVE-2026-81895 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
- Vulnerability reported to the Concrete CMS security team by Habib Allah
Technical Details for CVE-2026-81895
Vulnerability Analysis
The Document Library block persists file-set identifiers supplied via fsID[] into the btDocumentLibrary.setIds column without input validation. Concrete CMS treats the stored value as trusted content during page rendering. When setMode equals any, the block builder concatenates each stored identifier directly into the SQL filter clause used to select documents. No integer cast or parameterized binding is applied at either write time or read time.
An authenticated editor can therefore submit a crafted fsID[] value containing SQL syntax. That expression is stored once and re-executed on every subsequent render of the published page. The resulting injection is stored and blind, and time-based payloads such as SLEEP() allow inference of database contents through response latency.
Root Cause
The root cause is missing input validation combined with unsafe query construction [CWE-89]. The block handler neither enforces an integer type on fsID[] entries nor uses parameter binding when composing the filter query. Persisting untrusted input into btDocumentLibrary.setIds converts a single authenticated write into repeated server-side query execution.
Attack Vector
Exploitation requires an authenticated account with permission to add or edit a Document Library block, and requires user interaction to publish or view the affected page. The attacker configures the block with setMode set to any and injects SQL payloads through the fsID[] submission. Once the page is rendered, the injected SQL runs under the database credentials used by Concrete CMS.
See the ConcreteCMS Version 9.5.3 Release Notes for vendor details.
Detection Methods for CVE-2026-81895
Indicators of Compromise
- Non-integer or SQL-syntax content in the btDocumentLibrary.setIds column of the Concrete CMS database
- Unusually long request-processing times when rendering pages that contain Document Library blocks
- Audit-log entries showing edits to Document Library blocks by low-privilege editor accounts
- Database query logs containing SLEEP, BENCHMARK, or UNION tokens originating from document-library filter queries
Detection Strategies
- Query the btDocumentLibrary table and flag rows where setIds contains characters outside the set [0-9,]
- Enable MySQL or MariaDB slow query logging and correlate long-running queries with page render events
- Compare block-edit events against the roles permitted to modify Document Library blocks and alert on unexpected editors
Monitoring Recommendations
- Forward web-server, application, and database logs to a centralized analytics platform for correlation
- Baseline normal render latency for pages containing Document Library blocks and alert on statistical deviations
- Monitor authentication events for editor accounts and flag privilege changes granting block-edit rights
How to Mitigate CVE-2026-81895
Immediate Actions Required
- Upgrade Concrete CMS to version 9.5.3 or later without delay
- Audit the btDocumentLibrary.setIds column for any non-integer content and remediate affected rows
- Review recent edits to Document Library blocks and identify accounts that made suspicious changes
- Rotate database credentials if injection activity is confirmed
Patch Information
Concrete CMS addressed the issue in version 9.5.3. The fix validates fsID[] submissions as integers and applies safe query construction when building the file-set filter. Administrators should follow the upgrade instructions in the ConcreteCMS Version 9.5.3 Release Notes.
Workarounds
- Restrict permissions on the Document Library block so only trusted administrators can add or edit it
- Avoid using the block with setMode configured to any until the upgrade is complete
- Apply web-application firewall rules that reject non-numeric values in fsID[] submissions
- Enforce least-privilege database accounts so injected queries cannot alter schema or read unrelated tables
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
