CVE-2026-93659: Concrete CMS Community Store XSS Vulnerability

CVE-2026-93659 Overview

CVE-2026-93659 is a stored cross-site scripting (XSS) vulnerability in the Concrete CMS Community Store extension prior to version 2.7.8. The extension renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can inject script payloads into billing name, email, or phone fields during checkout. Those payloads execute when store managers view the affected orders in the administrative interface. The classification maps to [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can hijack authenticated manager sessions to create rogue administrative accounts or exfiltrate customer and order data from the store backend.

Affected Products

Concrete CMS Community Store extension versions prior to 2.7.8
elements/order_slip.php and related admin/checkout templates in v2.7.7 and earlier
Concrete CMS deployments with the Community Store add-on installed

Discovery Timeline

2026-09-18 - CVE-2026-93659 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93659

Vulnerability Analysis

The Community Store extension collects order data from unauthenticated checkout submissions and persists it to the database. Templates that render this data in the storefront and administrative back office write field values directly into HTML without applying the framework's h() escaping helper. When a store manager opens an order slip or cart view, the browser parses the attacker-supplied markup and executes any embedded JavaScript in the manager's session context.

The attack requires user interaction from a privileged operator, since the payload fires only when an authenticated manager views the affected order. Once triggered, the script runs with the manager's cookies and permissions, enabling rogue account creation, order manipulation, and data exfiltration from the admin interface.

Root Cause

The root cause is missing output encoding in Concrete CMS templates that render user-controlled order fields. The pre-patch code emitted values such as $quantityLabel and $actiondata['errorMsg'] using raw <?= $value ?> echoes instead of the framework-provided h() function. Concrete CMS exposes h() as the standard HTML escaping helper, and its absence in these templates breaks the output-encoding boundary between stored data and rendered HTML.

Attack Vector

An unauthenticated attacker submits a checkout order with a JavaScript payload placed in a text field such as billing name, email, or phone. The Community Store stores the raw value. When a store administrator later opens the order in the manager interface, the payload executes in the browser session of the administrator, allowing session-scoped actions against the CMS.

php

// Patch: elements/cart_list.php - add HTML escaping to quantity label output
<?php $quantityLabel = $csm->t($product->getQtyLabel(), 'productQuantityLabel', $product->getID()); ?>
<?php if ($quantityLabel) { ?>
<span class="store-cart-qty-label small">
-    <?= $quantityLabel; ?></span>
+    <?= h($quantityLabel); ?></span>
<?php
} ?>

// Patch: elements/cart_modal.php - escape error message before rendering
<p class="alert alert-warning">
    <?php
    if ($actiondata['errorMsg']){
-       echo $actiondata['errorMsg'];
+       echo h($actiondata['errorMsg']);
    } else {
        echo t('An issue has occured adding the product to the cart. You may be missing required information.');
    }

Source: GitHub Commit 2a802d6

Detection Methods for CVE-2026-93659

Indicators of Compromise

Order records containing HTML or JavaScript syntax (<script, onerror=, onload=, javascript:) in billing name, email, or phone fields.
Unexpected administrative account creation events shortly after a manager opens a suspicious order.
Outbound requests from administrator browser sessions to unfamiliar domains immediately after loading order pages.

Detection Strategies

Query the Community Store order tables for stored fields containing angle brackets or common XSS keywords and review matching orders.
Compare deployed Community Store versions against 2.7.8 across all Concrete CMS instances and flag any earlier releases.
Review web server access logs for POST requests to checkout endpoints containing URL-encoded script tags or JavaScript event handlers.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting on Concrete CMS admin routes to capture script-source violations from injected payloads.
Monitor administrative audit trails for new user creation, permission changes, and configuration edits performed shortly after order review.
Alert on anomalous session activity such as manager sessions issuing API requests from unusual user-agents or IP addresses.

How to Mitigate CVE-2026-93659

Immediate Actions Required

Upgrade the Community Store extension to version 2.7.8 or later on all Concrete CMS instances.
Audit existing orders for stored HTML or script content and sanitize or remove offending records before staff review them.
Rotate administrative credentials and invalidate active sessions if suspicious orders were opened prior to patching.

Patch Information

The vendor addressed the issue in GitHub Release v2.7.8 via commit 2a802d6, which applies the h() escaping helper to previously unescaped order and cart fields. See the VulnCheck Advisory for XSS for additional advisory context.

Workarounds

Restrict access to the Concrete CMS administrative interface using network-level controls or a VPN until the patch is applied.
Deploy a web application firewall rule to strip or block HTML tags in checkout form fields such as billing name, email, and phone.
Enforce a strict Content Security Policy that disallows inline scripts on administrative pages to limit payload execution.

bash

# Example CSP header for Concrete CMS admin routes
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always;

# Verify installed Community Store version
cd /path/to/concrete/packages/community_store
grep -R "'version'" controller.php