CVE-2026-81918 in Concrete CMS
Summary
by MITRE • 09/11/2026
Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with edit_page_contents permissions could store a payload which executes in the browser of any visitor who viewed a page where the block was configured to display a date-type attribute. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Oriol Ortiz for reporting.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
Concrete CMS versions prior to 9.5.3 contain a stored cross-site scripting vulnerability within the Page Attribute Display block, specifically affecting the Date Format configuration field. This flaw allows an attacker with edit_page_contents permissions to inject malicious script payloads into the system by manipulating how date attributes are rendered on web pages. The vulnerability arises because the application fails to properly sanitize or encode user-supplied input when processing the format string for display blocks, leading to the execution of arbitrary JavaScript code in the context of any visitor viewing a page where such a block is active and configured with a maliciously crafted attribute value.
The operational impact of this vulnerability centers on the ability to execute client-side scripts without direct interaction from the victim beyond visiting an affected page. Although the attack requires initial privileges, specifically edit_page_contents permissions, it represents a significant risk for internal threats or compromised accounts within the CMS environment. Once triggered, the stored payload can be used to steal session cookies, hijack user sessions, perform actions on behalf of authenticated users, or redirect visitors to malicious sites. The severity is quantified by a CVSS v4.0 score of 4.8, reflecting low attack complexity and no required user interaction for execution once the page is loaded, but requiring high privileges for initial exploitation.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). The specific mechanism involves stored XSS where malicious data is saved on the target server and later retrieved by other users. In terms of offensive security frameworks, this behavior maps to ATT&CK technique T1059 Command and Scripting Interpreter with sub-technique T1059.007 JavaScript, as well as potential credential access via T1539 Steal Web Session Cookie if the payload is designed for session hijacking. The lack of output encoding in the date format field creates a persistent vector that persists until the configuration is corrected or the malicious attribute value is removed from the database.
Mitigation strategies primarily involve upgrading Concrete CMS to version 9.5.3 or later, where this input validation issue has been addressed by implementing stricter sanitization and context-aware output encoding for all user-controlled fields within block configurations. Administrators should also enforce strict role-based access control policies to limit edit_page_contents permissions to trusted individuals only, reducing the attack surface for internal threat actors. Additionally, deploying a Web Application Firewall with rules capable of detecting and blocking XSS payloads in form submissions can provide an additional layer of defense against exploitation attempts while patching is being implemented across the infrastructure.