CVE-2026-81917: Concrete CMS XSS Vulnerability

CVE-2026-81917 Overview

CVE-2026-81917 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in Concrete CMS versions prior to 9.5.3. The flaw exists in the Document Library block, where the file description and tags fields are rendered without HTML output escaping. An authenticated user with permission to edit file properties can inject a script payload that executes in the browser of any visitor viewing a page that renders the affected block.

Critical Impact
Successful exploitation allows theft of session data and execution of actions in the visitor's browser context, including unauthenticated visitors who load pages containing the Document Library block with description or tags columns enabled.

Affected Products

Concrete CMS versions below 9.5.3
Document Library block component
concretecms:concrete_cms package

Discovery Timeline

Vulnerability reported by Nguyen Manh Thuan to the Concrete CMS security team
2026-09-11 - CVE-2026-81917 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-81917

Vulnerability Analysis

The vulnerability resides in the Document Library block controller and view template within Concrete CMS. The controller returns file description and tags values to the view without applying the h() HTML escaping function that is already applied to the title column. The block view template writes the returned values directly into the results table markup.

This inconsistency creates a stored XSS sink. A user with permission to modify file properties can persist a JavaScript payload in the description or tags fields. The payload is served to every visitor who loads a page containing the Document Library block configured with those columns visible.

Because the block can be rendered on public pages, the payload reaches unauthenticated visitors. The attacker gains script execution in the origin of the Concrete CMS site.

Root Cause

The root cause is missing output encoding at the presentation layer. The block controller trusts the stored values and the view template does not sanitize before writing them into HTML. The h() escaping helper was applied inconsistently across columns, protecting only the title while leaving description and tags exposed.

Attack Vector

Exploitation requires an authenticated account with permission to edit file properties. The attacker stores a script payload in the description or tags field of a file. Any subsequent page load rendering the Document Library block with those columns enabled triggers script execution. The scope includes unauthenticated visitors, expanding the attack surface beyond authenticated sessions.

See the ConcreteCMS Version 9.5.3 Release Notes for the vendor's technical description of the fix.

Detection Methods for CVE-2026-81917

Indicators of Compromise

File description or tag fields containing HTML tags such as <script>, <img onerror=>, or event handler attributes
Unexpected outbound requests from visitor browsers to attacker-controlled domains originating from pages rendering the Document Library block
Anomalous file property edits by low-privilege editors immediately followed by public page views

Detection Strategies

Query the file metadata store for description and tag values containing angle brackets, javascript: URIs, or common XSS payload patterns
Review web server access logs for requests to pages with the Document Library block that correlate with recent file property changes
Enable Content Security Policy (CSP) reporting to surface inline script execution attempts on pages using the block

Monitoring Recommendations

Monitor audit logs for file property modifications by accounts with editor-level permissions
Alert on script-like content submitted through Concrete CMS file management endpoints
Track browser errors and CSP violation reports on public pages that render Document Library content

How to Mitigate CVE-2026-81917

Immediate Actions Required

Upgrade Concrete CMS to version 9.5.3 or later
Audit existing file descriptions and tags for stored script payloads and remove any malicious content
Review and tighten permissions for the file properties edit capability, restricting it to trusted accounts

Patch Information

Concrete CMS resolved the issue in version 9.5.3 by applying the h() HTML escaping helper to the description and tags values returned by the Document Library block controller. Refer to the ConcreteCMS Version 9.5.3 Release Notes for full patch details.

Workarounds

Disable the Document Library block on public pages until the upgrade is applied
If the block must remain enabled, remove the description and tags columns from the block configuration
Deploy a strict Content Security Policy that disallows inline scripts to reduce the impact of stored XSS payloads

bash

# Example CSP header to restrict inline script execution
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'