CVE-2026-81899: Concrete CMS Stored XSS Vulnerability

CVE-2026-81899 is a stored XSS flaw in Concrete CMS versions 9.0.0 to 9.5.2 affecting group folder names on the Members dashboard. Attackers with folder permissions can inject scripts that execute in administrator sessions. This article covers technical details, affected versions, impact, and mitigation steps.

CVE-2026-81899 Overview

CVE-2026-81899 is a stored cross-site scripting (XSS) vulnerability in Concrete CMS versions 9.0.0 through 9.5.2. The flaw resides in the group folder management functionality of the Members > Groups dashboard. Concrete CMS stores submitted group folder names without HTML sanitization and renders them without output encoding on the Groups dashboard page. An authenticated user with the Add Group Folder permission can inject a script payload as a folder name. The payload executes in the browser session of any administrator who views the Groups dashboard. This vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation enables session and token theft, and grants the attacker any capability available in the targeted administrator's context.

Affected Products

Concrete CMS 9.0.0 through 9.5.2
Concrete CMS Members > Groups dashboard
Concrete CMS group folder add and edit handlers

Discovery Timeline

2026-09-15 - CVE-2026-81899 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database
Reported by Lý Chấn Hưng (hunglyvn) to the Concrete CMS security team

Technical Details for CVE-2026-81899

Vulnerability Analysis

The vulnerability exists in two code paths within Concrete CMS group folder management. The add and edit group-folder handlers accept a folder name from the submitting user and persist it directly to storage. No HTML entity encoding or tag filtering is applied at the point of storage. The group search grid then retrieves the folder name and injects it into the Members > Groups dashboard response body without output encoding. As a result, any HTML markup or JavaScript included in the folder name renders as live document markup in the administrator's browser.

The stored nature of the flaw increases its operational impact. The payload persists across sessions and executes automatically whenever any privileged user loads the affected dashboard. This eliminates the need for phishing or link delivery that a reflected XSS would require.

Root Cause

The root cause is missing input sanitization on write and missing output encoding on read. Neither the folder name handler nor the grid renderer treats the value as untrusted user input. This dual failure violates defense-in-depth expectations for CMS-managed content fields.

Attack Vector

An authenticated attacker holding the Add Group Folder permission submits a new folder or edits an existing folder. The attacker sets the folder name to a value containing JavaScript, for example an HTML tag with an event handler attribute or an inline script element. The payload is stored in the Concrete CMS database. When an administrator navigates to Members > Groups, the browser parses the injected markup and executes the attacker-controlled script under the administrator's origin. The attacker can then exfiltrate session cookies, steal CSRF tokens, create new administrative users, or perform any request the administrator is authorized to make. See the Concrete CMS Version 9.5 Release Notes for the associated fix.

Detection Methods for CVE-2026-81899

Indicators of Compromise

Group folder records in the Concrete CMS database containing HTML tags, <script> elements, or event handler attributes such as onerror or onload in the name field.
Unexpected outbound HTTP requests from administrator browsers immediately after loading the Members > Groups dashboard.
Newly created administrator accounts or elevated group memberships that do not correlate to a known change request.

Detection Strategies

Query the group folder table for name values that contain <, >, or JavaScript URI schemes and treat any match as suspicious.
Review web server access logs for POST requests to the group folder add and edit endpoints followed by GETs to the Members > Groups dashboard from administrator sessions.
Deploy a web application firewall (WAF) rule that inspects group folder name parameters for script injection patterns.

Monitoring Recommendations

Alert on any assignment or use of the Add Group Folder permission, since this permission is the exploitation prerequisite.
Monitor administrator session activity for anomalous API calls initiated from the Groups dashboard context.
Capture and retain HTTP request bodies for administrative endpoints to support post-incident investigation.

How to Mitigate CVE-2026-81899

Immediate Actions Required

Upgrade Concrete CMS to version 9.5.3 or later, which contains the vendor fix documented in the release notes.
Audit existing group folder names for embedded HTML or script content and remove or rename any suspicious entries before administrators access the dashboard.
Review the assignment of the Add Group Folder permission and restrict it to trusted accounts only.

Patch Information

Concrete CMS addressed the issue in the 9.5.3 release. Refer to the Concrete CMS Version 9.5 Release Notes for the full fix details and upgrade instructions.

Workarounds

Temporarily revoke the Add Group Folder permission from all non-administrator accounts until the upgrade is applied.
Deploy a WAF rule that blocks HTML metacharacters in the group folder name parameter on the add and edit endpoints.
Rotate administrator session cookies and API tokens after remediation to invalidate any credentials that may have been exfiltrated.

bash

# Verify installed Concrete CMS version and plan upgrade to 9.5.3+
cd /path/to/concrete
php bin/concrete5 c5:info | grep -i version