CVE-2026-81918: Concrete CMS Stored XSS Vulnerability

CVE-2026-81918 Overview

CVE-2026-81918 is a stored cross-site scripting (XSS) vulnerability in Concrete CMS versions below 9.5.3. The flaw resides in the Date Format field of the Page Attribute Display block. An authenticated user holding edit_page_contents permissions can inject a malicious payload that executes in the browser of any visitor viewing a page configured to display a date-type attribute. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation). Oriol Ortiz reported the issue to the Concrete CMS security team.

Critical Impact
Authenticated content editors can persist JavaScript that runs in every visitor's session, enabling session theft, credential harvesting, and unauthorized administrative actions.

Affected Products

Concrete CMS versions below 9.5.3
Page Attribute Display block component
Sites configured to render date-type page attributes

Discovery Timeline

2026-09-11 - CVE-2026-81918 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-81918

Vulnerability Analysis

The vulnerability lives in the rendering path of the Page Attribute Display block. When an editor configures the block to display a date-type page attribute, the Date Format field accepts operator-supplied input that is later interpolated into the rendered HTML without proper output encoding. Because the payload is persisted in the CMS database, it triggers on every subsequent page view without further attacker interaction.

Exploitation requires an account with the edit_page_contents permission, which limits the attack surface to users who already possess content-editing rights. The Concrete CMS security team scored this flaw under CVSS v4.0 with attack characteristics reflecting network exploitability, high privileges required, and passive user interaction. The impact set includes low confidentiality and integrity impact to the vulnerable component with no scope change.

Root Cause

The root cause is missing output sanitization on the Date Format field within the Page Attribute Display block template. The affected code path treats the format string as a trusted display directive rather than untrusted user input, allowing HTML and JavaScript to render verbatim in the browser context of visitors.

Attack Vector

An authenticated user with editor privileges navigates to a page and adds or edits a Page Attribute Display block configured to output a date-type attribute. The attacker enters a malicious payload into the Date Format field and saves the block. Any subsequent visitor loading the affected page executes the payload in their browser under the vulnerable site's origin, enabling session token access, DOM manipulation, and cross-site request forgery against authenticated administrators.

No verified public proof-of-concept exploit is available. Refer to the ConcreteCMS 9.5.3 Release Notes for the vendor's technical description of the fix.

Detection Methods for CVE-2026-81918

Indicators of Compromise

Page Attribute Display block records containing HTML tags, <script> elements, or JavaScript event handlers within the Date Format field.
Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages with date attribute blocks.
Modifications to page block configurations by low-privilege editor accounts followed by anomalous session activity.

Detection Strategies

Query the Concrete CMS database for Page Attribute Display block configurations and flag Date Format values containing angle brackets, javascript: URIs, or common XSS payload tokens.
Deploy a web application firewall rule set that inspects block-save requests for XSS patterns in form fields associated with the Page Attribute Display block.
Enable Content Security Policy (CSP) reporting to identify inline script execution on public-facing pages that should not contain executable content.

Monitoring Recommendations

Audit user accounts holding edit_page_contents permissions and log all block-modification events with before/after content diffs.
Alert on privileged administrative actions performed shortly after a session interacts with a page containing dynamic date attributes.
Track outbound network telemetry from browsers accessing CMS-hosted content for connections to unrecognized third-party domains.

How to Mitigate CVE-2026-81918

Immediate Actions Required

Upgrade Concrete CMS to version 9.5.3 or later, which contains the vendor-supplied fix.
Review all existing Page Attribute Display block configurations for suspicious Date Format entries and sanitize or remove them.
Rotate session cookies and credentials for any administrator that may have accessed compromised pages during the exposure window.

Patch Information

Concrete CMS resolved this issue in version 9.5.3. See the ConcreteCMS Version 9.5 Release Notes for release details and the full changelog covering the security fix.

Workarounds

Restrict the edit_page_contents permission to trusted administrative users until the patch is applied.
Implement a strict Content Security Policy that disallows inline script execution to limit the impact of stored XSS payloads.
Temporarily disable the Page Attribute Display block on public-facing pages that render date-type attributes if immediate patching is not feasible.

bash

# Upgrade Concrete CMS via Composer to the patched release
composer require concretecms/concretecms:^9.5.3

# Verify the installed version after upgrade
php concrete/bin/concrete5 c5:info | grep -i version