CVE-2026-81900 Overview
CVE-2026-81900 is a stored cross-site scripting (XSS) vulnerability in Concrete CMS versions prior to 9.5.3. The YouTube block applied only trim() to stored width and height values before rendering them into iframe HTML attributes. Missing output escaping and integer casting allowed a user with edit_block permission to inject an event handler that executes JavaScript when visitors render the affected page. When an administrator views the page, the injected script runs with administrative privileges, enabling account takeover and content manipulation. The Concrete CMS security team assigned this issue a CVSS v4.0 base score of 7.3. The flaw is tracked as CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated users with block edit rights can inject persistent JavaScript that executes in the context of administrators, leading to full site compromise.
Affected Products
- Concrete CMS versions prior to 9.5.3
- Concrete CMS YouTube block component
- Sites where non-administrative users hold edit_block permission
Discovery Timeline
- Reported by sh4d0byss to the Concrete CMS security team
- 2026-09-14 - CVE-2026-81900 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-81900
Vulnerability Analysis
The YouTube block in Concrete CMS accepts user-controlled width and height parameters that configure the embedded iframe. The block controller called trim() on these values before storing them and re-emitted them directly into the rendered HTML. Because the values were neither cast to integers nor HTML-escaped, an attacker could break out of the attribute context and inject arbitrary attributes, including event handlers such as onload or onerror. The payload persists in the page definition and executes each time the block renders.
Exploitation requires an authenticated account holding the edit_block capability on the target page. When an administrator subsequently loads the page, the injected script runs inside the administrator session. Attackers can then create new administrator accounts, alter site content, exfiltrate CSRF tokens, or pivot to other administrative endpoints. The persistent nature of the payload broadens the blast radius across all visitors and privilege levels.
Root Cause
The root cause is missing output encoding and type enforcement on stored input. The YouTube block treated width and height as opaque strings and relied on trim() alone. Numeric dimension fields should be cast to integers or validated against a strict numeric regular expression before being placed into HTML attributes. Additionally, all attribute values must be escaped using an HTML attribute encoder to neutralize characters such as ", ', <, and >.
Attack Vector
The attack vector is network-based and requires an authenticated session with block editing rights. An attacker edits a YouTube block, supplies a crafted string in the width or height field that terminates the attribute quote and appends an event handler, and saves the block. Any subsequent page render triggers the payload. Because the CVSS 4.0 vector specifies subsequent scope confidentiality, integrity, and availability as none, the impact is contained to the vulnerable application, but full compromise of that application is possible when an administrator triggers the payload.
A representative payload closes the dimension attribute and introduces an event handler that runs arbitrary JavaScript when the iframe loads. See the Concrete CMS 9.5.3 release notes for the vendor description of the fix.
Detection Methods for CVE-2026-81900
Indicators of Compromise
- YouTube block records whose stored width or height fields contain characters other than digits, such as quotes, angle brackets, on prefixed handlers, or the string javascript:.
- Unexpected creation of administrator accounts or role changes shortly after edits to pages containing YouTube blocks.
- Outbound requests from administrator browsers to unfamiliar domains immediately after loading a page with a YouTube block.
Detection Strategies
- Query the Blocks and block-specific tables for YouTube block instances and inspect the stored dimension values for non-numeric content.
- Deploy a Content Security Policy in report-only mode to surface inline script execution and unexpected event handler firing in rendered pages.
- Review web server and application audit logs for edit_block actions performed by non-administrative users on pages that administrators regularly access.
Monitoring Recommendations
- Alert on modifications to YouTube blocks by users who do not routinely author content.
- Monitor administrator sessions for anomalous API calls originating from page rendering contexts, such as user creation or permission changes.
- Continuously baseline the Concrete CMS version in use and flag any installation still running a release below 9.5.3.
How to Mitigate CVE-2026-81900
Immediate Actions Required
- Upgrade Concrete CMS to version 9.5.3 or later on all instances.
- Audit the assignment of the edit_block permission and revoke it from accounts that do not require content editing.
- Inspect existing YouTube blocks for malicious payloads in width and height fields and remove any tampered content.
Patch Information
Concrete CMS resolved the issue in release 9.5.3 by enforcing proper handling of stored width and height values in the YouTube block. Details are documented in the Concrete CMS 9.5.3 Release Notes. Administrators should follow the standard upgrade procedure and validate the version string after deployment.
Workarounds
- Restrict edit_block permission to fully trusted administrators until the patch is applied.
- Temporarily disable or remove the YouTube block type from available block palettes for lower-privileged roles.
- Enforce a strict Content Security Policy that blocks inline event handlers and unauthorized script sources to reduce the impact of injected payloads.
# Verify the installed Concrete CMS version after upgrade
php concrete/bin/concrete5 c5:info | grep -i version
# Example CSP header to restrict inline script execution
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; frame-src https://www.youtube.com; object-src 'none'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
