CVE-2026-81898 Concrete CMS CVE debrief

Who should care

Defenders responsible for Concrete CMS installations, particularly those with user-submitted content, should assess exposure and apply patches or workarounds to prevent exploitation. This includes administrators, security teams, and IT personnel who manage Concrete CMS deployments. They should verify the version of Concrete CMS and apply patches or workarounds if necessary to prevent exploitation of this vulnerability.

Why it matters

A stored XSS vulnerability in Concrete CMS versions below 9.5.3 allows attackers to execute script in dashboard user sessions, potentially leading to unauthorized actions and data compromise. Defenders should verify exposure, apply patches, and monitor for suspicious activity.

• Script execution in dashboard user sessions
• Potential for unauthorized actions
• Data theft or manipulation through XSS
• Verification of patch application and vulnerability remediation

Technical summary

The vulnerability exists in the Address attribute's country-less text formatter in Concrete CMS versions below 9.5.3. A user able to submit an Address attribute can execute script in the session of any dashboard user who opened the affected entry. The vulnerability was introduced due to a lack of HTML-escaping in the text formatter, which enabled the execution of malicious scripts. The CVSS v4.0 score of 7.5 indicates a high severity vulnerability that requires immediate attention from defenders. The vulnerability can be exploited through a network attack, and the attack complexity is low.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or workarounds to prevent exploitation.

Recommended defensive actions

• Verify Concrete CMS version and apply patch or workaround if necessary
• Restrict user input for Address attributes to prevent script injection
• Monitor dashboard user sessions for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported by Yonatan Drori from Tenzai and assigned a CVSS v4.0 score of 7.5. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The source-provided information indicates that the vulnerability exists in Concrete CMS versions below 9.5.3 and that defenders should verify exposure and apply patches or workarounds.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.