CVE-2026-81897: Concrete CMS Stored XSS Vulnerability

CVE-2026-81897 Overview

CVE-2026-81897 is a stored cross-site scripting (XSS) vulnerability in Concrete CMS versions below 9.5.3. The flaw resides in the save_control action of the Express entities forms dashboard controller, which fails to validate the anti-CSRF token. A remote unauthenticated attacker can craft a forged cross-site request that, when submitted by an authenticated administrator, writes attacker-controlled headline and body values to an existing Express form Text control. The Express form Text element emits those values without output encoding, causing injected markup to execute as persistent JavaScript in any administrator session that later views the affected entry. The vulnerability is classified under CWE-79.

Critical Impact
A successful attack chains CSRF with stored XSS to execute arbitrary JavaScript in administrator browsers, enabling session theft, account takeover, and full compromise of the Concrete CMS instance.

Affected Products

Concrete CMS versions prior to 9.5.3
Express entities forms dashboard controller (save_control action)
Express form Text control element

Discovery Timeline

2026-09-15 - CVE-2026-81897 published to NVD
2026-09-16 - Last updated in NVD database
Reported by Yonatan Drori from Tenzai

Technical Details for CVE-2026-81897

Vulnerability Analysis

The vulnerability combines two distinct weaknesses in the Concrete CMS Express forms subsystem. First, the save_control endpoint in the Express entities forms dashboard controller omits anti-CSRF token validation. This allows an attacker-controlled origin to trigger authenticated write operations. Second, the Express form Text element renders stored headline and body fields into the administrator dashboard without applying output encoding.

When an authenticated administrator visits a malicious page, the browser submits the forged request using the administrator's session cookies. The server accepts the request and persists the attacker's payload to the Text control record. Any administrator who later opens the affected entry executes the injected JavaScript in the context of the CMS origin.

The stored nature of the payload extends the blast radius beyond the initial victim. Every subsequent administrator viewing the compromised entry becomes an execution target, amplifying credential theft and lateral movement inside the administration interface.

Root Cause

The root cause is a missing CSRF token check on a state-changing dashboard action, combined with the absence of contextual output encoding when rendering the persisted headline and body fields. The Text element trusts stored content and inserts it directly into the DOM.

Attack Vector

Exploitation requires an unauthenticated remote attacker to host a crafted page and lure an authenticated Concrete CMS administrator into visiting it. The attacker's page issues a cross-origin POST to the save_control endpoint carrying malicious headline or body values. Because no CSRF token is required, the request succeeds under the administrator's session. See the ConcreteCMS 9.5.3 Release Notes for vendor-published details.

Detection Methods for CVE-2026-81897

Indicators of Compromise

Unexpected POST requests to the Express entities forms save_control endpoint originating from external referrers.
Express form Text controls containing <script> tags, event handler attributes such as onerror or onload, or javascript: URI schemes in headline or body fields.
Administrator sessions issuing anomalous API calls or exfiltration requests shortly after opening an Express form entry.

Detection Strategies

Review web server access logs for POST requests to Concrete CMS dashboard controller paths with cross-origin Referer or Origin headers.
Query the Concrete CMS database for Express form Text control records whose headline or body columns contain HTML tags or JavaScript syntax.
Deploy web application firewall rules that flag missing or invalid CSRF tokens on save_control requests.

Monitoring Recommendations

Enable audit logging for administrative modifications to Express entities and forward the logs to a centralized SIEM.
Alert on new or modified Express form controls performed outside of change-management windows.
Monitor administrator browser sessions for outbound requests to unrecognized domains that could indicate cookie or token exfiltration.

How to Mitigate CVE-2026-81897

Immediate Actions Required

Upgrade Concrete CMS to version 9.5.3 or later, which introduces the missing CSRF validation and proper output encoding.
Audit all existing Express form Text controls for previously injected payloads and sanitize or delete affected entries.
Rotate administrator credentials and invalidate active sessions if suspicious modifications are found.

Patch Information

Concrete CMS resolved the issue in version 9.5.3. The fix adds anti-CSRF token validation to the save_control action and applies contextual output encoding to the Express form Text element. Detailed remediation notes are available in the ConcreteCMS 9.5.3 Release Notes.

Workarounds

Restrict administrative access to the Concrete CMS dashboard using network-level allow lists or VPN gateways to reduce exposure to forged cross-site requests.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and untrusted script sources on administrative pages.
Instruct administrators to use dedicated browsers or profiles for CMS management and to avoid browsing untrusted sites while authenticated.

bash

# Example Content Security Policy header to reduce stored XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'";