CVE-2026-81898 Overview
CVE-2026-81898 is a stored cross-site scripting (XSS) vulnerability [CWE-79] affecting Concrete CMS versions below 9.5.3. The flaw resides in the Address attribute's country-less text formatter, which skipped HTML-escaping when rendering association views. A low-privileged user who can submit an Address attribute can inject script that executes in the browser of any dashboard user who opens the affected Express entry. The Concrete CMS security team assigned a CVSS v4.0 base score of 7.5.
Critical Impact
Authenticated attackers with content-submission rights can execute arbitrary JavaScript in dashboard user sessions, enabling account takeover, privilege escalation, and administrative action hijacking.
Affected Products
- Concrete CMS versions below 9.5.3
- Express association views rendering Address attributes
- Dashboard templates using concrete/elements/express/form/view/dashboard/association.php
Discovery Timeline
- 2026-09-15 - CVE-2026-81898 published to NVD
- 2026-09-16 - Last updated in NVD database
- Reported by Yonatan Drori from Tenzai
Technical Details for CVE-2026-81898
Vulnerability Analysis
The vulnerability stems from inconsistent output encoding in Concrete CMS's Address attribute handling. When an Address attribute lacks a country value, the text formatter takes a branch that returns the address content without applying HTML escaping. This unescaped output is then rendered inside Express association views, where the association label mask is echoed directly without the h() escaping helper.
Express is Concrete CMS's data modeling framework used to define custom entities and their relationships. Association views display linked records in the dashboard, making them a high-value target for stored XSS. Any script injected through the Address attribute executes with the privileges of the viewing dashboard user.
The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Exploitation requires low privileges and user interaction, since a dashboard operator must open the affected Express entry to trigger the payload.
Root Cause
Two defects combine to produce the vulnerability. First, the Address attribute is not marked required and accepts a blank country value, which routes rendering through a code path that omits HTML escaping. Second, several Express association templates, including concrete/elements/express/form/view/dashboard/association.php, echo the association label mask directly to the response body without wrapping the value in the h() output-encoding function.
Attack Vector
An attacker with permission to submit an Address attribute crafts a payload where the country field is left blank and the address text contains JavaScript such as an HTML <script> tag or event handler. When a dashboard user later opens the parent Express entry, the association view renders the raw payload and executes it in the victim's authenticated session. This can be leveraged to exfiltrate session cookies, perform actions as the victim, or pivot to administrative accounts.
The vulnerability manifests in the Address attribute text formatter and the Express association templates. See the ConcreteCMS 9.5.3 Release Notes for full technical details.
Detection Methods for CVE-2026-81898
Indicators of Compromise
- Address attribute values containing HTML tags, <script> blocks, or JavaScript event handlers such as onerror and onload
- Dashboard responses returning Express association pages with unencoded angle brackets in address label positions
- Unexpected outbound requests from dashboard user browsers to attacker-controlled domains shortly after viewing Express entries
Detection Strategies
- Review Concrete CMS database records for Address attribute rows where the country column is null or empty and the address text contains HTML metacharacters
- Inspect application logs for POST requests to Express entity endpoints submitted by low-privileged accounts, correlated with subsequent dashboard views
- Enable and monitor Content Security Policy (CSP) violation reports on the /dashboard path to surface inline script execution attempts
Monitoring Recommendations
- Alert on dashboard sessions that issue unexpected administrative API calls immediately after loading an Express association view
- Track creation and modification events on Express entities by non-administrative users
- Monitor web server access logs for anomalous parameter content submitted to Address attribute fields
How to Mitigate CVE-2026-81898
Immediate Actions Required
- Upgrade Concrete CMS to version 9.5.3 or later on all production and staging instances
- Audit existing Address attribute records for embedded HTML or JavaScript content and sanitize or remove offending entries
- Review Express entity permissions to restrict Address attribute submission to trusted user groups until patching is complete
Patch Information
Concrete CMS resolved this vulnerability in version 9.5.3. The fix applies HTML escaping in the Address attribute's text formatter for the country-less branch and adds h() calls around association label mask output in the affected Express templates. Review the ConcreteCMS 9.5.3 Release Notes for the complete list of security fixes included in this release.
Workarounds
- Mark Address attributes as required with a country value to bypass the vulnerable formatter branch
- Deploy a web application firewall rule that blocks Address attribute submissions containing HTML metacharacters
- Restrict dashboard access to hardened administrator workstations and enforce a strict Content Security Policy that disallows inline script execution
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
