CVE-2026-81910 in Concrete CMS
Summary
by MITRE • 09/11/2026
Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer (color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and ImageStyle) are interpolated into server-compiled LESS source without neutralization of LESS syntax, allowing a user with the Theme Customization permission to inject arbitrary LESS directives. By injecting the @import (inline) directive, an attacker can read arbitrary files on the server and reach internal network resources through PHP stream wrappers. The compiled output, including any disclosed file contents, is written to the site's publicly served CSS cache, exposing database credentials, private keys, and other application secrets, and enabling server-side request forgery. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.9 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
Concrete CMS versions 9 through 9.5.2 contain a critical Server-Side Template Injection vulnerability within the Theme Customizer module, specifically affecting how style values are processed and compiled into CSS output. The flaw resides in the handling of user-supplied input such as color channels, font families, and image paths submitted via the ColorStyle and related Style classes. These inputs are interpolated directly into server-compiled LESS source code without adequate sanitization or neutralization of special characters that hold syntactic meaning within the LESS preprocessor language. This lack of validation allows an authenticated user possessing the Theme Customization permission to inject arbitrary LESS directives rather than simple style values, fundamentally altering the compilation process on the backend.
The operational impact of this vulnerability is severe due to the capabilities inherent in the LESS syntax and PHP stream wrappers. By injecting specific malicious payloads such as the @import directive with inline parameters, an attacker can force the server-side compiler to read arbitrary files from the local filesystem. This capability extends beyond simple file disclosure; it enables Server-Side Request Forgery by leveraging PHP stream wrappers to access internal network resources that are not directly exposed to the public internet. The compiled CSS output, which includes any data extracted through these injection techniques, is subsequently written to a publicly accessible cache directory on the web server. This mechanism effectively turns the application into an information disclosure vector and a proxy for accessing sensitive infrastructure components.
The security implications of this flaw are profound as it leads to the exposure of highly sensitive application secrets stored in plain text within configuration files or environment variables. Attackers can retrieve database credentials, private keys used for encryption and signing, API tokens, and other authentication materials that compromise the integrity and confidentiality of the entire system. The disclosure of these secrets allows for further exploitation phases including full account takeover, data exfiltration, and potential lateral movement within the network if internal services are compromised via SSRF techniques. This vulnerability aligns with CWE-94 Improper Control of Generation of Code or Script typically associated with injection flaws where user input is not properly validated before being used in code generation contexts.
From a tactical perspective, this exploitation path maps to ATT&CK technique T1059 Command and Scripting Interpreter for the execution of injected directives and T1078 Valid Accounts as it requires legitimate authentication privileges to trigger. The attack vector also relates to CWE-200 Information Exposure through an unintended information channel where sensitive data is written to a publicly accessible location via the compromised compilation process. To mitigate this risk, administrators should immediately update Concrete CMS to version 9.5.3 or later which addresses these input validation gaps. In environments where immediate patching is not feasible, restricting Theme Customization permissions to only trusted administrative users and implementing strict web application firewall rules that block suspicious LESS syntax patterns in POST requests can provide temporary protection against exploitation attempts.