CVE-2026-81910: Concrete CMS SSRF Vulnerability

CVE-2026-81910 Overview

CVE-2026-81910 is a Server-Side Template Injection (SSTI) vulnerability in Concrete CMS versions 9 through 9.5.2. The flaw resides in the Theme Customizer, where style values submitted through ColorStyle, FontFamilyStyle, ImageStyle, and sibling classes are interpolated into server-compiled LESS source without neutralizing LESS syntax. An authenticated user holding the Theme Customization permission can inject arbitrary LESS directives, including @import (inline), to read arbitrary files and reach internal network resources through PHP stream wrappers. Compiled output is written to the publicly served CSS cache, exposing database credentials, private keys, and other application secrets.

Critical Impact
Authenticated attackers with Theme Customization permission can exfiltrate server-side files, harvest application secrets, and pivot to internal network resources via SSRF.

Affected Products

Concrete CMS 9.0 through 9.5.2
Themes leveraging ColorStyle, FontFamilyStyle, and ImageStyle classes
Sites exposing the Theme Customizer to non-administrator users with customization rights

Discovery Timeline

Vulnerability reported by Yonatan Drori of Tenzai
2026-09-11 - CVE-2026-81910 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-81910

Vulnerability Analysis

The Theme Customizer in Concrete CMS accepts style properties such as color channels, font families, and image references, then interpolates them directly into LESS source that the server compiles into CSS. Because the customizer does not neutralize LESS syntax within submitted values, an attacker can break out of the intended value context and inject arbitrary LESS directives. This condition maps to [CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine].

The LESS compiler honors the @import (inline) directive, which reads the target resource verbatim and embeds it into the compiled output. When combined with PHP stream wrappers, this primitive extends beyond local file reads to arbitrary network fetches, producing a server-side request forgery (SSRF) condition. The compiled CSS is stored in the site's public cache directory, so any disclosed content, including database credentials, TLS private keys, and framework secrets, becomes retrievable by unauthenticated clients over HTTP.

Root Cause

The root cause is missing sanitization inside the style value handlers. ColorStyle and its sibling classes concatenate user-controlled input into LESS templates without escaping LESS metacharacters or restricting directives. The LESS compiler treats the resulting source as trusted and executes directives such as @import (inline) during compilation.

Attack Vector

Exploitation requires network access to the Concrete CMS instance and an account with the Theme Customization permission. The attacker submits crafted style values through the customizer that terminate the intended LESS expression and append an @import (inline) directive pointing to a local file path or a URL handled by a PHP stream wrapper. After the theme is compiled, the attacker retrieves the resulting CSS asset from the public cache and extracts the leaked file contents or SSRF response body.

No verified public proof-of-concept code has been published. See the ConcreteCMS Release Notes 9.5.3 for the vendor's technical description of the fix.

Detection Methods for CVE-2026-81910

Indicators of Compromise

Presence of LESS directives such as @import, @plugin, or data-uri( inside stored theme customization values in the database.
Compiled CSS files under the public cache directory containing file paths, key material, environment variables, or non-CSS content such as PHP source.
Outbound HTTP requests from the web server to internal or metadata endpoints originating from the LESS compilation process.

Detection Strategies

Audit database records that store theme customizer values for LESS metacharacters, @ directives, and URL schemes such as php://, file://, or http://.
Diff the CSS cache directory against a known-good baseline and alert on files containing secrets, credentials, or non-CSS tokens.
Enable application logging around the theme compilation pipeline to record which user submitted style changes and when compilation ran.

Monitoring Recommendations

Monitor web server egress traffic for unexpected connections to 127.0.0.1, cloud metadata IPs such as 169.254.169.254, and internal RFC1918 ranges.
Track privilege assignments for the Theme Customization permission and alert on grants to non-administrator roles.
Review access logs for downloads of CSS assets that are abnormally large or requested from unusual sources.

How to Mitigate CVE-2026-81910

Immediate Actions Required

Upgrade Concrete CMS to version 9.5.3 or later, which contains the vendor fix documented in the release notes.
Revoke the Theme Customization permission from all non-administrator user groups until the upgrade is completed.
Rotate database credentials, API keys, TLS private keys, and application secrets that resided on the server, since exposure via the CSS cache cannot be ruled out.

Patch Information

Concrete CMS addressed the issue in the 9.5.3 release. Consult the ConcreteCMS Release Notes 9.5.3 for the full set of security fixes and upgrade instructions.

Workarounds

Restrict the Theme Customization permission to fully trusted administrators only.
Block PHP stream wrappers by configuring allow_url_fopen=Off and allow_url_include=Off in php.ini to reduce the SSRF surface.
Place the CSS cache directory behind authentication or purge it after each theme change to limit exposure of any leaked content.

bash

# Configuration example - harden PHP against stream-wrapper abuse
allow_url_fopen = Off
allow_url_include = Off
open_basedir = "/var/www/concrete:/tmp"