Executive brief
Concrete CMS is a website management platform used to build and maintain content-driven websites. An authenticated editor with administrative privileges can inject malicious JavaScript into page paths, which executes in the browser of other editors viewing the duplicate-path confirmation dialog. This allows attackers to steal session credentials, modify pages, or perform actions on behalf of legitimate users within the CMS.
Technical details
This is a stored/reflected cross-site scripting (XSS) vulnerability in the page location panel's duplicate-path confirmation dialog. The root cause is improper output encoding: the panel's check endpoint returns a user-supplied page path unmodified in its JSON response, and client-side JavaScript then inserts this value directly into the dialog as raw HTML without escaping. An authenticated editor with sufficient privileges can craft a malicious page path containing script tags (e.g., <script>...</script>) that will execute in the browser of any other user who views the duplicate-path confirmation. No special preconditions are needed beyond authentication and editor-level permissions. An attacker can execute arbitrary JavaScript in the victim's authenticated session context, potentially leading to credential theft, unauthorized content modification, or further lateral movement within the CMS. Patches addressing output encoding are available in versions after 9.5.2.
Affected products
- Concrete CMS Concrete CMS 9.4.0 through 9.5.2
Timeline
- 2026-09-15: disclosed
- other: CVE-2026-81926 assigned