PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8353 Concrete CMS CVE debrief

A Stored XSS vulnerability exists in Concrete CMS versions 9.0 to 9.5.0, specifically in the Atomik theme, allowing a rogue editor to inject arbitrary JavaScript that executes in the context of any authenticated user visiting affected account pages. This can lead to session hijacking, credential theft, malicious actions performed on behalf of users, and potential privilege escalation. The vulnerability has a CVSS v4.0 score of 2.1, indicating low severity.

Vendor
Concrete CMS
Product
Unknown
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-22
Original CVE updated
2026-07-23
Advisory published
2026-05-22
Advisory updated
2026-07-23

Who should care

Administrators and users of Concrete CMS versions 9.0 to 9.5.0, particularly those using the Atomik theme, should be aware of this vulnerability and take necessary precautions to prevent exploitation. This includes updating to version 9.5.1 or later, restricting editor privileges, and implementing additional security measures.

Technical summary

The vulnerability is caused by insufficient input validation and sanitization of page names in the Atomik theme of Concrete CMS. An attacker with editor privileges can inject malicious JavaScript code, which is then stored and executed when other authenticated users access the affected pages. This issue affects Concrete CMS versions 9.0 to 9.5.0. The CVSS v4.0 score for this vulnerability is 2.1, indicating a low severity.

Defensive priority

Low

Recommended defensive actions

  • Update Concrete CMS to version 9.5.1 or later
  • Restrict editor privileges to prevent malicious code injection
  • Monitor user activity and page content for suspicious behavior
  • Implement additional security measures, such as input validation and content sanitization
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-05-22T15:16:26.793Z and last modified on 2026-07-23T16:10:00.137Z. The NVD entry is currently Analyzed. This information is based on the supplied source corpus. Defenders should verify the accuracy of this information within the limits of publicly available data.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8353 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8353

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8353 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8353

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes

    ff5b8ace-8b95-4078-9743-eac1ca5451de - Release Notes, Vendor Advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.