Executive brief
Concrete CMS, a popular open-source content management system, contains a reflected cross-site scripting (XSS) vulnerability in its conversation messaging feature. An attacker can inject malicious JavaScript through a crafted date format parameter and trick a user into submitting it, allowing the attacker to steal session cookies, deface the page, or perform actions on behalf of the logged-in user. The vulnerability is particularly easy to exploit because the vulnerable endpoint lacks CSRF protection.
Technical details
The vulnerability is a reflected XSS flaw in Concrete CMS's conversation message rendering code. The root cause is improper neutralization (insufficient output encoding) of user-supplied custom date format strings when rendering conversation messages. An attacker can craft a malicious POST request containing JavaScript payload in the date format parameter and deliver it to a victim user. The attack requires the victim to be authenticated (PR:L) and to interact with a link or form submission (UI:P), but is aided by the absence of CSRF token validation on the endpoint, enabling cross-origin exploitation. The vulnerability affects versions before 9.5.3, and a patch is available in that version.
Affected products
- Concrete CMS Concrete CMS before 9.5.3
Timeline
- 2026-09-15: disclosed: CVE-2026-81925 published
- 2026-09-15: patched: Fixed in version 9.5.3