CVE-2026-81911 Concrete CMS CVE debrief

Who should care

Defenders responsible for Concrete CMS installations, particularly those with versions 9.0.0 to 9.5.2, should assess exposure and prioritize patching or mitigations. This includes reviewing the current version of Concrete CMS, identifying all instances of the Boards feature, and determining the level of access that users have to edit board contents.

Why it matters

This vulnerability allows an attacker with permission to edit board contents to store a forged summary object with a JavaScript-bearing HTML payload, which executes in the browser of users who view the affected board slot, potentially leading to session or action takeover and escalation toward an administrator.

• Session or action takeover by an attacker
• Escalation toward an administrator
• Execution of JavaScript-bearing HTML payload in the browser of users who view the affected board slot

Technical summary

The custom_slot save_template endpoint authorizes the request only against the target board instance and persists the client-supplied selectedTemplateOption[collection] verbatim, rather than rebuilding the content object collection server-side and verifying that each item belongs to the authorized board's data pool. A user with permission to edit the contents of at least one board instance can therefore store a forged summary object whose description field carries a JavaScript-bearing HTML payload. The default summary template renders the description field without output encoding, so the payload executes in the browser of any user who views the affected board slot.

Defensive priority

Defenders should prioritize verifying exposure of Concrete CMS versions 9.0.0 to 9.5.2 and applying patches or mitigations.

Recommended defensive actions

• Verify exposure of Concrete CMS versions 9.0.0 to 9.5.2
• Apply patches or mitigations
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS v4.0 score of 5.8 and vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N. The vulnerability was reported by riodrwn. Concrete CMS versions below 9 do not include the Boards feature and are not affected. The default summary template renders the description field without output encoding, allowing the payload to execute.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.