CVE-2026-18113 in Concrete CMS
Summary
by MITRE • 09/15/2026
In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could create or rename pages could store a script through a child page name and have it run in the browser of any visitor, editor, or administrator who viewed the navigation and opened the affected dropdown. In the Concrete CMS origin, the script executed with the victim's privileges and could read same-origin content or perform actions available to that user. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks labixiaoxin97 for reporting.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in Concrete CMS versions 9.0 through 9.5.2 represents a significant cross-site scripting flaw rooted in insufficient input validation and output encoding within the Top Navigation Bar block functionality. This component is responsible for rendering hierarchical page structures into navigational menus, specifically handling dropdown lists that display child pages of a selected parent node. The core technical failure lies in the application's processing pipeline where page titles are retrieved from the database and injected directly into HTML content without applying appropriate escaping mechanisms such as HTML entity encoding or context-aware sanitization. When an authenticated user with permissions to create new pages or rename existing ones, they can inject malicious JavaScript payloads by embedding script tags or event handlers within the title field of a child page. Because the rendering engine fails to neutralize these special characters before outputting them into the DOM structure of the navigation menu, the browser interprets the injected code as executable content rather than static text data.
From an operational perspective, this vulnerability allows for stored cross-site scripting attacks that persist on the server side until the malicious page name is removed or corrected. The impact is particularly severe because it affects any user who views a page containing the affected navigation block and interacts with the dropdown menu to reveal its children. This includes not only casual visitors but also editors, administrators, and other authenticated users within the CMS environment. Since Concrete CMS typically operates as a single-origin application for most deployments, the executed script runs in the security context of the victim's session. Consequently, an attacker can leverage this execution capability to steal sensitive cookies containing authentication tokens, read confidential content stored on same-origin pages, or perform state-changing actions such as modifying site settings, deleting content, or escalating privileges by impersonating the victim user. The attack does not require social engineering beyond convincing a target with sufficient permissions to create or rename a page, and it triggers automatically upon navigation interaction without requiring additional clicks beyond opening the dropdown.
The severity of this vulnerability is quantified by a CVSS v4.0 base score of 7.5, classified as High. The vector string CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N indicates that the attack is network-accessible and requires low complexity to execute. While it demands a high privilege level for the initial attacker, meaning only authenticated users with page creation or renaming rights can exploit it, there are no user interface interactions required beyond standard navigation behavior. The vulnerability results in high confidentiality, integrity, and availability impacts due to the potential for full session hijacking and data manipulation within the application context. However, since the impact is confined to the same origin, there is no cross-origin information leakage or system-wide compromise, which limits the scope of damage to SC:N, SI:N, and SA:N values in the assessment model.
This flaw aligns with CWE-79, commonly known as Improper Neutralization of Input During Web Page Generation, specifically reflecting a failure to apply output encoding for HTML contexts. In terms of offensive security frameworks, this vulnerability facilitates techniques associated with MITRE ATT&CK ID T1059, which covers Command and Scripting Interpretation via stored payloads that execute in the context of other users. The persistence mechanism relies on CWE-83, Persistent Cross-Site Scripting, where malicious data is stored within a web application database or file system and later retrieved by victims without further validation. To mitigate this risk, administrators must upgrade Concrete CMS to version 9.5.3 or later where the Top Navigation Bar block has been patched to properly escape page titles before rendering them in HTML attributes and text nodes. Additionally, implementing Content Security Policy headers can provide a layer of defense-in-depth by restricting script execution sources, although upgrading remains the primary remediation strategy for this specific code-level defect.