CVE-2026-81898 in Concrete CMS
Summary
by MITRE • 09/15/2026
In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user able to submit an Address attribute could execute script in the session of any dashboard user who opened the affected entry. The unescaped branch was reachable because a non-required Address attribute accepted a blank country, and because several Express association templates (for example concrete/elements/express/form/view/dashboard/association.php) echoed the association label mask without applying h(). The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in Concrete CMS versions prior to 9.5.3 represents a critical stored cross-site scripting flaw located within the Address attribute handling mechanism of the Express content management system. This security defect arises specifically from the country-less text formatter, which fails to apply proper HTML-escaping when processing user-supplied data. The root cause lies in the logic that handles address entries where no specific country is selected or provided by the end-user. In such scenarios, the application enters a code branch intended for formatting addresses without geographic context, but this path neglects to sanitize output before rendering it within Express association views. Consequently, any malicious script embedded within an Address attribute value remains unescaped and executable in the browser of subsequent viewers.
The operational impact of this vulnerability is significant due to its stored nature and the high-privilege environment where execution occurs. An attacker with the ability to submit content containing a crafted Address attribute can inject JavaScript payloads that persist on the server side. When any dashboard user, who typically possesses administrative or elevated privileges within the CMS interface, opens an entry associated with this malicious data, the injected script executes in their active session context. This allows for potential account takeover, theft of sensitive administrative credentials, manipulation of content management operations, and broader compromise of the web application's integrity. The attack vector is classified as network-based with low complexity, requiring only that a privileged user view the compromised entry, which aligns with typical usage patterns in CMS dashboards where administrators frequently review submitted data or associations.
From a technical classification perspective, this vulnerability maps directly to CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). Specifically, it is an instance of stored XSS because the malicious payload persists within the application's database and is served to other users upon request. In terms of adversary tactics, this aligns with MITRE ATT&CK techniques related to Client-side Injection and potentially Credential Access if session cookies or tokens are harvested. The vulnerability exploits a logic error in input validation combined with insufficient output encoding, highlighting a common pattern where developers assume certain fields will always contain specific data types or values, leading to conditional branches that bypass security controls like HTML entity encoding functions such as h() which were correctly applied elsewhere but omitted here.
The Concrete CMS security team has assigned this issue a CVSS v4.0 severity score of 7.5 indicating High risk. The vector string CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N reflects that the attack is remote, requires low complexity, and involves user interaction but no additional environmental constraints beyond standard web browsing. The high impact on confidentiality, integrity, and availability stems from the ability to execute arbitrary code in privileged sessions. Mitigation strategies primarily involve upgrading Concrete CMS to version 9.5.3 or later where this specific formatting branch has been corrected to enforce HTML escaping regardless of whether a country value is present. For organizations unable to patch immediately, implementing strict input validation on Address fields and deploying Web Application Firewall rules that detect script injection patterns in form submissions can provide temporary defense-in-depth measures until the official fix is applied.