CVE-2026-81903 Overview
CVE-2026-81903 is a stored cross-site scripting (XSS) vulnerability in Concrete CMS versions 9.0.0 through 9.5.2. The flaw resides in the Page Containers dashboard, where user-submitted icon values are stored without validation against the known container icon set. A helper function later concatenates the value into the src attribute of an img tag without encoding attribute output. Any editor or administrator viewing the Containers dashboard list or editor triggers execution of the attacker-controlled script in their authenticated session. Exploitation enables session token theft and privileged dashboard actions. Concrete CMS assigned the issue a CVSS v4.0 score of 7.0. Andrew Gonzalez reported the vulnerability.
Critical Impact
An authenticated user with delegated Page Containers access can execute arbitrary script in the browser of any editor or administrator who loads the Containers dashboard, enabling account takeover.
Affected Products
- Concrete CMS 9.0.0 through 9.5.2
- Concrete CMS Page Containers dashboard component
- Concrete CMS icon rendering helper
Discovery Timeline
- 2026-09-14 - CVE-2026-81903 published to NVD
- 2026-09-18 - Last updated in NVD database
Technical Details for CVE-2026-81903
Vulnerability Analysis
The vulnerability is a stored cross-site scripting flaw classified under [CWE-79]. Concrete CMS accepts the Page Container icon value submitted through the dashboard and persists it without checking whether the value belongs to the known container icon set. When the Containers dashboard list and editor views render, a helper concatenates the stored value directly into the src attribute of an img element. The helper does not perform HTML attribute encoding on the output.
An attacker with delegated Page Containers access supplies a crafted icon string that terminates the src attribute and injects new attributes or tags. The injected payload executes in the browser context of any editor or administrator who loads the affected view. Because the script runs inside an authenticated dashboard session, it can read session tokens, issue authenticated requests, and perform privileged actions on behalf of the victim.
Root Cause
The root cause is missing input validation on the Page Container icon field combined with missing output encoding in the icon rendering helper. The application trusts the stored icon value and inserts it verbatim into HTML attribute context. Either an allowlist check at input or context-aware attribute encoding at output would break the exploitation chain.
Attack Vector
Exploitation requires an authenticated account with high privileges over the Page Containers area and user interaction from a second victim account. The attacker submits a malicious icon value through the dashboard, and the payload persists in the database. When another editor or administrator opens the Containers list or editor, the browser parses the malformed img tag and executes the injected JavaScript. The attack targets adjacent network positioning against the CMS backend.
See the ConcreteCMS 9.5.3 Release Notes for the vendor's technical description of the fix.
Detection Methods for CVE-2026-81903
Indicators of Compromise
- Page Container records whose icon field contains characters such as ", <, >, or on event handler prefixes rather than a value from the known icon set.
- Dashboard audit log entries showing container create or update actions from accounts that do not normally manage containers.
- Outbound requests from editor or administrator browsers to unknown domains immediately after loading the Containers dashboard.
- Session tokens for privileged accounts appearing in requests originating from unexpected IP addresses.
Detection Strategies
- Query the containers table for stored icon values that do not match the allowed icon identifier pattern.
- Inspect web server access logs for POST requests to Page Container endpoints followed by anomalous GET traffic from administrative accounts.
- Deploy a Content Security Policy in report-only mode and monitor violation reports generated when the Containers dashboard renders.
Monitoring Recommendations
- Alert on privileged dashboard actions performed within seconds of an editor loading the /dashboard/pages/container views.
- Monitor Concrete CMS user permission changes for unexpected escalations following container edits.
- Track new administrator sessions established from browser user agents that match existing editor sessions.
How to Mitigate CVE-2026-81903
Immediate Actions Required
- Upgrade Concrete CMS to version 9.5.3 or later on all instances running 9.0.0 through 9.5.2.
- Audit existing Page Container records and remove or normalize any icon values that do not match the known icon set.
- Review accounts with delegated Page Containers permissions and revoke access that is not required.
- Invalidate active administrator and editor sessions after patching to eliminate tokens that may have been stolen.
Patch Information
Concrete CMS addressed the vulnerability in the 9.5.3 release. The fix validates submitted icon values against the known container icon set and applies attribute-safe encoding in the rendering helper. Details are available in the ConcreteCMS 9.5.3 Release Notes.
Workarounds
- Restrict the Page Containers dashboard permission to a minimal set of trusted administrators until the upgrade is applied.
- Deploy a strict Content Security Policy that disallows inline script and unexpected external sources in dashboard responses.
- Place a web application firewall rule in front of the Page Container submission endpoint to reject payloads containing HTML metacharacters in the icon field.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
