CVE-2026-81896: Concrete CMS Stored XSS Vulnerability

CVE-2026-81896 is a stored cross-site scripting vulnerability in Concrete CMS affecting versions before 9.5.3. Rogue editors can inject malicious scripts into Form block labels that execute in administrator browsers. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-81896 Overview

CVE-2026-81896 is a stored cross-site scripting (XSS) vulnerability in Concrete CMS versions before 9.5.3. The flaw resides in the Dashboard Form Submissions report at concrete/single_pages/dashboard/reports/forms/legacy.php. The application fails to apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers. A rogue editor with authoring privileges can store markup or script in a label. That payload then executes in the browser of any administrator who opens the submissions report for the affected form. The vulnerability is tracked under [CWE-79] and was reported by Yonatan Drori of Tenzai.

Critical Impact
An authenticated low-trust editor can execute arbitrary JavaScript in an administrator's browser session, enabling account takeover of higher-privileged Dashboard users.

Affected Products

Concrete CMS versions prior to 9.5.3
Concrete CMS Dashboard Form Submissions report component
concrete/single_pages/dashboard/reports/forms/legacy.php

Discovery Timeline

2026-09-15 - CVE-2026-81896 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-81896

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the Dashboard reporting interface of Concrete CMS. Form block question labels, which are user-controllable through the CMS editor interface, are persisted and later rendered as HTML column headers in the submissions report. The rendering code path in legacy.php outputs these labels without applying HTML entity encoding. Any HTML markup or <script> payload embedded in a label executes in the context of the Dashboard when an administrator loads the corresponding submissions view. Because the payload runs in an administrator session, it can perform privileged Dashboard actions, exfiltrate session cookies, or pivot to further compromise the site.

Root Cause

The root cause is missing output encoding in concrete/single_pages/dashboard/reports/forms/legacy.php. The template treats stored form question labels as trusted data and emits them directly into the HTML response. Concrete CMS 9.5.3 addresses the issue by applying HTML entity encoding to these labels before rendering, per the Concrete CMS 9.5.3 Release Notes.

Attack Vector

Exploitation requires an authenticated user with permission to create or edit Form blocks. The attacker inserts a JavaScript payload into a form question label instead of legitimate text. The payload is stored server-side and remains dormant until an administrator opens the Dashboard Form Submissions report. When the report page renders the column headers, the browser parses the injected markup and executes the script under the Dashboard origin. Victim interaction is limited to navigating to the affected report, which is a routine administrative task.

Detection Methods for CVE-2026-81896

Indicators of Compromise

Form block question labels containing HTML tags, <script> elements, event handler attributes such as onerror or onload, or javascript: URIs
Unexpected outbound requests originating from administrator browser sessions immediately after loading /dashboard/reports/forms/legacy
Newly created administrator accounts, changed passwords, or modified user roles following a Dashboard report view
Audit log entries showing form label edits by low-privilege editor accounts followed by administrator access to the submissions report

Detection Strategies

Query the Concrete CMS database for Form block question labels containing <, >, script, on\w+=, or javascript: patterns
Monitor web server access logs for requests to concrete/single_pages/dashboard/reports/forms/legacy.php and correlate with prior form edits
Review Concrete CMS activity logs for form modifications performed by non-administrator roles

Monitoring Recommendations

Enable and centralize Concrete CMS application logs alongside web server logs in a SIEM for correlation
Alert on anomalous JavaScript execution patterns in administrator sessions, such as unexpected fetch or XMLHttpRequest calls to external hosts
Track privilege changes and account creation events that occur in the same session as a Dashboard report page load

How to Mitigate CVE-2026-81896

Immediate Actions Required

Upgrade all Concrete CMS instances to version 9.5.3 or later without delay
Audit existing Form block question labels for stored HTML or script content and sanitize any suspicious entries
Review the editor role membership and revoke Form block editing rights from any account that does not require them
Rotate administrator session tokens and credentials if evidence of exploitation is found

Patch Information

Concrete CMS resolved the vulnerability in release 9.5.3 by applying HTML entity encoding to form question labels rendered by concrete/single_pages/dashboard/reports/forms/legacy.php. Full remediation details are available in the Concrete CMS 9.5.3 Release Notes.

Workarounds

Restrict Form block creation and editing permissions to trusted administrator-level accounts until the patch is applied
Deploy a Web Application Firewall rule that blocks POST bodies containing HTML tags in form question label parameters
Add a Content Security Policy header to the Dashboard that disallows inline script execution to reduce payload impact

bash

# Configuration example: verify Concrete CMS version and upgrade
php concrete/bin/concrete5 c5:info | grep -i version
# If below 9.5.3, back up the database and files, then upgrade
php concrete/bin/concrete5 c5:update