PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8353 Concrete CMS CVE debrief

A Stored XSS vulnerability exists in Concrete CMS versions 9.0 to 9.5.0, specifically in the Atomik theme, allowing a rogue editor to inject arbitrary JavaScript that executes in the context of any authenticated user visiting affected account pages. This can lead to session hijacking, credential theft, malicious actions performed on behalf of users, and potential privilege escalation. The vulnerability has a CVSS v4.0 score of 2.1, indicating low severity.

Vendor
Concrete CMS
Product
Unknown
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-22
Original CVE updated
2026-07-23
Advisory published
2026-05-22
Advisory updated
2026-07-23

Who should care

Administrators and users of Concrete CMS versions 9.0 to 9.5.0, particularly those using the Atomik theme, should be aware of this vulnerability and take necessary precautions to prevent exploitation. This includes updating to version 9.5.1 or later, restricting editor privileges, and implementing additional security measures.

Technical summary

The vulnerability is caused by insufficient input validation and sanitization of page names in the Atomik theme of Concrete CMS. An attacker with editor privileges can inject malicious JavaScript code, which is then stored and executed when other authenticated users access the affected pages. This issue affects Concrete CMS versions 9.0 to 9.5.0. The CVSS v4.0 score for this vulnerability is 2.1, indicating a low severity.

Defensive priority

Low

Recommended defensive actions

  • Update Concrete CMS to version 9.5.1 or later
  • Restrict editor privileges to prevent malicious code injection
  • Monitor user activity and page content for suspicious behavior
  • Implement additional security measures, such as input validation and content sanitization
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-05-22T15:16:26.793Z and last modified on 2026-07-23T16:10:00.137Z. The NVD entry is currently Analyzed. This information is based on the supplied source corpus. Defenders should verify the accuracy of this information within the limits of publicly available data.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-05-22T15:16:26.793Z and has not been modified since then. The NVD entry is currently Analyzed.