CVE-2026-81927: Concrete CMS SVG Upload XSS Vulnerability

CVE-2026-81927 Overview

CVE-2026-81927 is a stored cross-site scripting (XSS) vulnerability in Concrete CMS versions prior to 9.5.3. The flaw affects SVG file handling when the concrete.file_manager.images.svg_sanitization.action setting is configured to the non-default reject mode. Uploaded SVG files were validated only against a small built-in blocklist covering the <script> element and on* event-handler attributes. Vectors such as a javascript: URI in an xlink:href attribute passed through unmodified and executed when the file was opened directly in a browser. The default sanitize mode was not affected. Oriol Ortiz reported the issue [CWE-79].

Critical Impact
An authenticated user with file upload permissions can store SVG payloads that execute arbitrary JavaScript in the browser of any user who views the file directly.

Affected Products

Concrete CMS versions before 9.5.3
Installations configured with concrete.file_manager.images.svg_sanitization.action = reject
File manager components handling SVG uploads

Discovery Timeline

2026-09-15 - CVE-2026-81927 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-81927

Vulnerability Analysis

The vulnerability resides in the SVG upload validation path of Concrete CMS. When administrators configured the file manager to use the reject sanitization mode, the platform intended to block SVG files containing potentially harmful elements rather than strip them. However, the enforcement logic only compared uploads against a narrow built-in blocklist covering the <script> element and on* event-handler attributes.

The broader enshrined/svg-sanitize pass still executed during processing, but its sanitized output was discarded. As a result, dangerous vectors that the library would have removed, including javascript: URIs embedded in xlink:href attributes, remained in the stored file. Any user who opened the SVG directly in a browser executed the attacker-supplied JavaScript in the context of the hosting domain.

Root Cause

The root cause is an incomplete validation blocklist combined with a discarded sanitization result. The reject mode assumed the built-in blocklist covered all executable SVG constructs. It did not account for URI-based script execution vectors carried through attributes such as xlink:href, href, or other elements that accept navigable URIs.

Attack Vector

An attacker with file upload privileges crafts a malicious SVG file. The payload embeds a javascript: URI inside an xlink:href attribute rather than using a <script> element or on* handler. The file passes the blocklist check and is stored on the server. When a victim opens the SVG file directly through a browser, the JavaScript executes under the origin of the Concrete CMS site, enabling session token theft, forced administrative actions, or further payload delivery.

A verified proof-of-concept is not publicly available. See the Concrete CMS 9.5.3 Release Notes for vendor technical details.

Detection Methods for CVE-2026-81927

Indicators of Compromise

SVG files in the Concrete CMS file manager containing xlink:href or href attributes with javascript: URIs
SVG uploads submitted by non-administrative accounts with unusual attribute structures or embedded URIs
Web server access logs showing direct requests to .svg files followed by anomalous authenticated actions

Detection Strategies

Scan existing SVG assets for javascript:, data:, and other executable URI schemes embedded in attributes
Review file upload audit trails for accounts that recently uploaded SVG content, correlating with subsequent privileged actions
Monitor browser telemetry and web application firewall logs for script execution originating from SVG file paths

Monitoring Recommendations

Alert on SVG file uploads from user roles that do not typically require SVG assets
Track direct file access patterns to /application/files/ or equivalent storage paths for anomalies
Log the effective value of concrete.file_manager.images.svg_sanitization.action and alert on drift from the default configuration

How to Mitigate CVE-2026-81927

Immediate Actions Required

Upgrade Concrete CMS to version 9.5.3 or later
If patching is not immediately possible, revert the svg_sanitization.action setting to its default sanitize mode
Audit existing SVG assets for javascript: URIs and other executable content, removing suspect files
Restrict file upload permissions to trusted user roles only

Patch Information

Concrete CMS addressed the issue in version 9.5.3. The fix ensures the enshrined/svg-sanitize result is honored when the reject mode is active, rather than falling back to the narrow built-in blocklist. Refer to the Concrete CMS 9.5.3 Release Notes for upgrade guidance.

Workarounds

Set concrete.file_manager.images.svg_sanitization.action to the default sanitize mode until the upgrade is applied
Disable SVG uploads entirely for untrusted user groups through file type restrictions
Serve user-uploaded SVG content from a sandboxed domain with a restrictive Content Security Policy to limit script execution impact

bash

# Configuration example: enforce default SVG sanitization mode
# In application/config/concrete.php (or equivalent environment config):
return [
    'file_manager' => [
        'images' => [
            'svg_sanitization' => [
                'action' => 'sanitize',
            ],
        ],
    ],
];