CVE-2026-81895 Concrete CMS CVE debrief

Who should care

Defenders responsible for Concrete CMS deployments, especially those with users permitted to add or edit Document Library blocks, should assess exposure and prioritize verification or updates.

Why it matters

CVE-2026-81895 is a high-severity vulnerability in Concrete CMS that allows for stored, time-based blind SQL injection. Defenders should prioritize verifying exposure, especially for users with permission to add or edit Document Library blocks, and assess the need for updates or compensating controls.

• Potential for stored, time-based blind SQL injection
• Risk of unauthorized database queries
• Need for validation of user input
• Importance of updating to a fixed version

Technical summary

The Document Library block in Concrete CMS before 9.5.3 improperly handles file-set identifiers by storing them without validation as integers. When the block's setMode is set to 'any', these identifiers are directly concatenated into the file-set filter query instead of being cast or bound as parameters. This oversight allows for stored, time-based blind SQL injection attacks. An authenticated user with permission to add or edit a Document Library block can exploit this vulnerability, potentially leading to unauthorized database queries. The vulnerability's CVSS v4.0 score is 8.5, indicating high severity.

Defensive priority

Defenders should prioritize verifying exposure in Concrete CMS deployments, especially for users with permission to add or edit Document Library blocks, and assess the need for updates or compensating controls.

Recommended defensive actions

• Verify Concrete CMS version and check if using a Document Library block with setMode set to any
• Assess user permissions and limit access to add or edit Document Library blocks
• Consider updating to Concrete CMS version 9.5.3 or later
• Monitor for suspicious activity related to the Document Library block
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, including its CVSS v4.0 score of 8.5 and vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The vulnerability affects Concrete CMS versions before 9.5.3.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.