CVE-2026-81925: Concrete CMS XSS Vulnerability

CVE-2026-81925 Overview

CVE-2026-81925 is a reflected cross-site scripting (XSS) vulnerability in Concrete CMS versions prior to 9.5.3. The flaw exists in the conversation message rendering logic, where a user-supplied custom date format is not properly neutralized before output. An attacker can execute arbitrary JavaScript in a victim's browser by tricking the victim into submitting a crafted POST request to the conversation view endpoint. The absence of a Cross-Site Request Forgery (CSRF) token on the endpoint amplifies the issue, enabling delivery through an auto-submitting cross-origin form. The vulnerability is tracked under [CWE-79].

Critical Impact
Attackers can execute arbitrary JavaScript in an authenticated user's browser session, enabling session abuse, UI manipulation, and data theft within the Concrete CMS context.

Affected Products

Concrete CMS versions prior to 9.5.3

Discovery Timeline

2026-09-15 - CVE-2026-81925 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database
Reported by Yonatan Drori from Tenzai

Technical Details for CVE-2026-81925

Vulnerability Analysis

The vulnerability resides in the conversation message rendering path of Concrete CMS. When a user submits a request containing a custom date format value, the application incorporates that value into the rendered HTML output without adequate sanitization or encoding. Because the input is reflected back in the response, an attacker-controlled payload can break out of the intended context and execute as JavaScript in the victim's browser.

The issue is compounded by a missing CSRF token on the conversation view endpoint. Without CSRF protection, an attacker-hosted page can silently issue a cross-origin POST that carries the malicious payload on behalf of an authenticated user. This eliminates the need for the attacker to steal credentials or interact directly with the target session.

Execution occurs in the origin of the Concrete CMS instance, granting the payload access to session cookies not marked HttpOnly, document contents, and any privileged actions the victim can perform through the interface.

Root Cause

The root cause is improper neutralization of input during web page generation. The conversation view code path accepts a user-supplied custom date format string and injects it into HTML output without contextual output encoding, producing a reflected XSS sink.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a web page that auto-submits a POST request to the vulnerable conversation view endpoint on the target Concrete CMS site. When an authenticated user visits the attacker-controlled page, the browser transmits the payload cross-origin. The server reflects the malicious date format into the rendered response, and the browser executes the injected script under the Concrete CMS origin.

No verified public exploit code is available. See the Concrete CMS 9.5.3 Release Notes for vendor-provided remediation details.

Detection Methods for CVE-2026-81925

Indicators of Compromise

Inbound POST requests to Concrete CMS conversation view endpoints originating from external Referer headers or lacking a same-origin Referer.
HTTP request bodies containing suspicious characters or tags such as <script, onerror=, javascript:, or encoded variants inside date format parameters.
Anomalous cross-origin form submissions targeting authenticated Concrete CMS sessions.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect POST bodies to conversation endpoints for HTML/JavaScript metacharacters in date format fields.
Alert on POST requests to the conversation view endpoint whose Referer or Origin header does not match the Concrete CMS host.
Correlate authenticated user sessions with unexpected script-like content reflected in application responses.

Monitoring Recommendations

Enable verbose HTTP request logging on the Concrete CMS application layer for conversation-related endpoints.
Monitor Content Security Policy (CSP) violation reports for inline script or unsafe-eval events tied to conversation pages.
Track browser-side error telemetry and CSP reports to identify users who may have received a reflected payload.

How to Mitigate CVE-2026-81925

Immediate Actions Required

Upgrade all Concrete CMS installations to version 9.5.3 or later.
Audit conversation-related endpoints for missing CSRF tokens and add server-side CSRF validation where absent.
Review recent access logs for cross-origin POST activity against conversation view endpoints.

Patch Information

Concrete CMS resolved the issue in version 9.5.3 by properly neutralizing the custom date format input during conversation message rendering. Refer to the Concrete CMS 9.5.3 Release Notes for the full changelog and upgrade guidance.

Workarounds

Restrict access to conversation features to trusted authenticated users only, using role-based access controls.
Enforce a strict Content Security Policy (CSP) that blocks inline scripts and unauthorized script sources to limit XSS payload execution.
Configure the application and reverse proxy to require SameSite=Strict cookies, reducing the effectiveness of cross-origin CSRF-delivered payloads.

bash

# Configuration example: restrictive CSP header for Concrete CMS
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'"
Header set X-Content-Type-Options "nosniff"
Header edit Set-Cookie ^(.*)$ $1;\ SameSite=Strict;\ Secure