CVE-2026-81900 in Concrete CMS
Summary
by MITRE • 09/15/2026
Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML attributes without escaping or integer casting, resulting in stored cross-site scripting. A user with edit_block permission could inject an event handler that executed script for visitors rendering the page, acting with administrative privileges where the victim was an administrator. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks sh4d0byss for reporting.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in Concrete CMS versions prior to 9.5.3 represents a critical stored cross-site scripting flaw rooted in insufficient input validation and output encoding within the YouTube block module. The core technical deficiency lies in how the application handles user-supplied dimensions for embedded video players. Specifically, when administrators or users with edit_block permissions configure the width and height of a YouTube embed, the system applies only basic whitespace trimming via the trim() function to these values. This operation removes leading and trailing spaces but fails to enforce type safety by casting the input into an integer format nor does it apply HTML entity encoding before rendering the data back into the browser context. Consequently, any special characters or script tags embedded within the dimension fields are preserved in their raw form rather than being neutralized as harmless text strings.
This lack of sanitization allows a malicious actor with edit_block privileges to inject arbitrary JavaScript code directly into the iframe HTML attributes that render the video player on public-facing pages. By crafting a payload such as an event handler like onload or onclick within the width or height parameter, the attacker can ensure that when another user views the page containing this compromised block, their browser executes the injected script in the context of the site. This execution occurs without any additional prompting to the victim, classifying it strictly as stored cross-site scripting rather than reflected variants which require more complex interaction vectors for successful exploitation.
The operational impact of this vulnerability is significant due to its potential for privilege escalation and widespread data compromise. Since Concrete CMS often involves collaborative content management where multiple users have editing rights, an attacker with relatively low-level permissions can plant persistent malicious code that affects all visitors viewing the affected page. If a victim with administrative privileges accesses such a page while authenticated, the injected script executes within their session context. This enables the attacker to perform actions on behalf of the administrator, including modifying site configurations, stealing sensitive data, or further propagating malware across the platform. The severity is underscored by the CVSS v4.0 score of 7.3, which reflects high confidentiality and integrity impacts despite requiring authenticated access with specific permissions for initial exploitation.
From a classification perspective, this vulnerability aligns closely with CWE-89 Improper Neutralization of Special Elements used in an SQL Command if one considers analogous injection principles, but more accurately maps to CWE-79 Cross-site Scripting: Stored due to the persistence of the payload within the application's database or file storage. In terms of offensive security frameworks, this behavior corresponds to MITRE ATT&CK technique T1059 Command and Scripting Interpreter through browser-based scripting environments like JavaScript, specifically leveraging stored payloads for persistent access. The attack vector is network-accessible but requires prior authentication with edit_block permissions, placing it in the medium complexity category regarding initial access requirements while maintaining high exploitability due to the simplicity of the injection method.
Mitigation strategies must focus on implementing robust input validation and secure output encoding practices within the CMS core or custom blocks. Developers should enforce strict type casting by converting all dimension inputs into integers before storage, thereby rejecting any non-numeric characters that could contain malicious payloads. Additionally, even if integer casting is applied as a primary defense layer, applying context-specific HTML entity encoding during the rendering phase provides essential defense-in-depth against potential bypasses or future code changes that might relax validation rules. Upgrading to Concrete CMS version 9.5.3 or later resolves this issue by implementing these necessary security controls. Organizations running older versions should prioritize immediate patching and review access logs for any signs of unauthorized block modifications indicative of exploitation attempts before the update is applied.