CVE-2026-81894 Concrete CMS CVE debrief

Who should care

Defenders responsible for Concrete CMS installations, particularly those with user-generated content or public-facing pages, should assess exposure and prioritize verification and remediation.

Why it matters

Defenders should prioritize verifying and updating Concrete CMS installations to prevent exploitation of this XSS vulnerability, which could lead to unauthorized JavaScript execution, data integrity issues, and compromised user sessions.

• Potential for unauthorized JavaScript execution in visitor browsers
• Possible impact on data integrity and confidentiality
• Required verification of Concrete CMS version and exposure
• Potential for compromised user sessions or unauthorized actions

Technical summary

The vulnerability exists in the Gallery block's per-image Caption field in Concrete CMS 9.5.2 and below. A user with permission to edit a page containing a Gallery block can store a caption that executes in the browser of any visitor who opens that image's lightbox due to the bundled Magnific Popup lightbox script re-parsing the attribute-decoded caption as HTML. This issue allows a user with permission to edit a page containing a Gallery block to store a caption that executes in the browser of any visitor who opens that image's lightbox. The vulnerability is due to the bundled Magnific Popup lightbox script re-parsing the attribute-decoded caption as HTML through jQuery's .append() in titleSrc instead of

Defensive priority

Defenders should prioritize verifying and updating Concrete CMS installations to prevent exploitation of this XSS vulnerability.

Recommended defensive actions

• Verify and update Concrete CMS installations to version 9.5.3 or later
• Restrict editing permissions for the Gallery block to authorized users
• Monitor for suspicious activity on Concrete CMS installations
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, including its CVSS v4.0 score of 8.5 and vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. This information is sourced from official records and should be verified with the vendor for accuracy. Defenders should review the official advisory for specific details on affected versions and recommended actions. The vulnerability exists in Concrete CMS versions 9.5.2 and below, and defenders should assess exposure and prioritize

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.