CVE-2026-81926: Concrete CMS XSS Vulnerability

CVE-2026-81926 Overview

CVE-2026-81926 is a stored cross-site scripting (XSS) vulnerability [CWE-79] affecting Concrete CMS versions 9.4.0 through 9.5.2. The flaw resides in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returns the submitted page path unmodified in its JSON response. Client-side JavaScript then inserts each returned value into the dialog as raw HTML. A crafted page path executes script in the editor's authenticated browser session. Yonatan Drori from Tenzai reported the issue to the Concrete CMS security team.

Critical Impact
An authenticated attacker with high privileges can inject JavaScript that executes in another editor's browser session, enabling limited confidentiality, integrity, and availability impact within the CMS editor context.

Affected Products

Concrete CMS 9.4.0
Concrete CMS 9.4.x releases through 9.5.1
Concrete CMS 9.5.2

Discovery Timeline

2026-09-15 - CVE-2026-81926 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-81926

Vulnerability Analysis

The vulnerability is a stored XSS in the Concrete CMS location panel. When an editor attempts to create a page whose path collides with an existing page, the panel calls a check endpoint to confirm duplication. That endpoint echoes the submitted path back inside a JSON response without HTML-encoding or sanitizing the value.

The front-end JavaScript then renders the returned path into the confirmation dialog using a raw HTML insertion sink rather than a text-only sink. Any HTML or script markup embedded in the path is parsed and executed by the editor's browser. Because the payload is delivered through a stored page path, it persists across sessions and fires whenever another authenticated editor triggers the duplicate-path workflow.

Exploitation requires an attacker who already holds page-creation privileges and requires interaction from a second privileged user. The impact is limited to the Concrete CMS editor context, but that context includes editor cookies, CSRF tokens, and administrative actions accessible from the browser session.

Root Cause

The root cause is missing output encoding on a server-supplied value combined with an unsafe DOM sink. The check endpoint trusts the caller-supplied path and returns it verbatim. The client-side dialog assumes the response is safe and writes it as HTML rather than as text content.

Attack Vector

An authenticated user with permission to create or rename pages submits a page path containing an HTML or script payload. The location panel's check endpoint stores or echoes the path. When another editor opens the location panel and triggers the duplicate-path confirmation dialog, the payload is inserted into the DOM and executes under that editor's origin and session.

No verified exploit code is publicly available. See the Concrete CMS 9.5.3 Release Notes for the vendor's technical description.

Detection Methods for CVE-2026-81926

Indicators of Compromise

Page path values in the Concrete CMS database containing HTML tags, angle brackets, javascript: URIs, or event handler attributes such as onerror= or onload=.
Application logs showing calls to the location panel's duplicate-path check endpoint with paths containing script-like characters.
Unexpected outbound HTTP requests from editor browsers immediately after opening the location panel.

Detection Strategies

Review Concrete CMS access logs for requests to the location panel check endpoint containing suspicious characters in the path parameter.
Query the pages table for entries whose path column contains <, >, ", or script substrings.
Deploy a Content Security Policy in report-only mode and monitor CSP violation reports originating from CMS editor pages.

Monitoring Recommendations

Alert on anomalous editor session activity such as unexpected privilege changes, new administrator accounts, or plugin installations following location panel usage.
Correlate web server logs with authentication events to identify editors whose sessions were active when malicious paths were rendered.
Track outbound network connections from editor workstations to non-corporate domains during CMS administrative sessions.

How to Mitigate CVE-2026-81926

Immediate Actions Required

Upgrade Concrete CMS to version 9.5.3 or later, which contains the vendor fix.
Audit existing page paths for HTML or script content and rename or delete any suspicious entries.
Restrict page-creation and page-rename privileges to the minimum set of trusted editors until patching completes.

Patch Information

Concrete CMS addressed CVE-2026-81926 in the 9.5.3 release. The fix encodes the path value returned by the duplicate-path check endpoint and replaces the unsafe HTML sink in the location panel dialog with a text-only insertion. Review the Concrete CMS 9.5.3 Release Notes for the full change list and upgrade guidance.

Workarounds

Enforce a strict Content Security Policy on CMS administrative routes to block inline script execution.
Temporarily disable the location panel duplicate-path workflow for non-administrator roles if custom permissions allow it.
Require multi-factor authentication on all editor accounts to raise the cost of session-hijack follow-on attacks.

bash

# Example Content-Security-Policy header for Concrete CMS admin routes
# Add to your web server configuration (nginx example)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;