CVE-2026-18116 in Concrete CMS
Summary
by MITRE • 09/15/2026
Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approval and deletion notifications shown in the dashboard "Waiting For Me" block. A registered user permitted to add events to a calendar governed by an approval workflow could submit an event whose name contained a script payload, which then executed in an administrator's browser when the pending request was displayed and could be used to create a new administrator account. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks v01demort for reporting.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in Concrete CMS versions 8.3.0 through 9.5.2 represents a critical stored cross-site scripting flaw rooted in insufficient input validation and output encoding within the platform's administrative notification system. Specifically, the application fails to sanitize calendar event names during storage and subsequently renders these values without applying HTML escaping when generating workflow approval or deletion notifications. This architectural oversight allows malicious actors who possess the permission to add events to a calendar governed by an approval workflow to inject executable script payloads directly into the database. The severity of this flaw is underscored by its ability to persist in the system's data store, ensuring that every time the compromised content is rendered for authorized users, the malicious code executes automatically without requiring further interaction from the victim beyond viewing the notification block.
From an operational perspective, the impact of this vulnerability extends far beyond simple defacement or session hijacking due to its specific execution context within the administrative dashboard. The affected notifications are displayed in the Waiting For Me block, a central hub for administrators managing pending workflow requests. When an administrator views their queue of pending approvals, the browser parses and executes the injected script contained within the unsanitized event name. This automatic execution enables attackers to perform actions with the privileges of the viewing administrator. In documented instances, this capability was leveraged to create new administrative accounts, effectively granting persistent unauthorized access to the CMS backend. The ability to escalate privileges from a standard user role to an administrator role via client-side code injection highlights the severe compromise of integrity and confidentiality within the application environment.
The technical classification of this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). More specifically, it falls under Stored XSS where malicious scripts are permanently stored on target servers such as in a database or message forum and then executed whenever users request information from the server. Furthermore, this attack vector maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter via browser-based execution, allowing attackers to automate administrative tasks remotely. The CVSS v4.0 score of 7.3 reflects high confidentiality and integrity impacts with low availability impact, driven by the fact that while an attacker requires a registered account (High Privileges Required), they do not need physical proximity or complex conditions to exploit it once access is gained.
Mitigation strategies for this vulnerability must address both immediate remediation and long-term defensive coding practices. Administrators should immediately update Concrete CMS to version 9.5.3 or later, where the security team has implemented proper sanitization of calendar event names during storage and enforced HTML escaping during rendering in notification blocks. For organizations unable to patch immediately, implementing a Web Application Firewall rule that detects and blocks script tags within user-supplied input destined for calendar fields can provide temporary relief. Additionally, enforcing strict Content Security Policy headers on the administrative dashboard can help mitigate the impact of any remaining XSS vectors by restricting the sources from which scripts are allowed to execute. Regular security audits focusing on output encoding in all notification systems and workflow interfaces are recommended to prevent similar flaws in other modules.