CVE-2026-81917 Concrete CMS CVE debrief

Who should care

Concrete CMS administrators and users with permission to edit file properties should assess their exposure and take remediation steps to prevent exploitation. This includes reviewing and sanitizing user-input data for file properties, implementing additional security measures to prevent XSS attacks, and ensuring that all users with permission to edit file properties are aware of the vulnerability and its potential impacts.

Why it matters

This vulnerability allows an attacker to execute malicious script code in the browser of a visitor to a page displaying the Document Library block, potentially leading to theft of session data or actions performed in the visitor's context. Concrete CMS administrators and users with permission to edit file properties should assess their exposure and take remediation steps to prevent exploitation.

• Theft of session data or actions performed in the visitor's context
• Potential for unauthorized actions to be performed on behalf of the visitor
• Possible disruption of service or modification of sensitive data

Technical summary

The vulnerability exists in the Document Library block of Concrete CMS, where the file description and tags fields do not apply HTML output escaping. This allows a user with permission to edit file properties to store a script payload that executes in the browser of any visitor to a page displaying the block with the description or tags column enabled. Successful exploitation could allow theft of session data or actions performed in the visitor's context. The block controller returned the description and tags values without the h() escaping already applied to the title column, and the block view template wrote the returned value directly into the results table. The Concrete CMS security team gave this a CVSS v4

Defensive priority

Medium

Recommended defensive actions

• Update Concrete CMS to version 9.5.3 or later
• Review and sanitize user-input data for file properties
• Implement additional security measures to prevent XSS attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported by Nguyen Manh Thuan and assigned a CVSS v4.0 score of 5.1 by the Concrete CMS security team. The vulnerability exists in the Document Library block of Concrete CMS, where the file description and tags fields do not apply HTML output escaping.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.