CVE-2026-18111

Concrete CMS 9 before 9.5.3 (Feature, Feature Link, Hero Image, and Image blocks) and Concrete CMS 8 before 8.5.21 (Feature and Image blocks) fail to properly validate and output-escape the external link URL field. A user with page-editing permissions as limited as Add Block plus Edit Contents on a single page can store a crafted link value that breaks out of the link markup and injects arbitrary JavaScript. The script then runs in the browser of anyone who views, previews, or edits the affected page, enabling session hijacking and privilege escalation up to full administrative takeover. The vendor rates it CVSS v4.0 8.5 (high) with high privileges required to plant the payload and user interaction needed to trigger it. No public proof of concept or confirmed in-the-wild exploitation is known, and it is not in the CISA KEV catalog.

What to do: Upgrade Concrete CMS 9 to 9.5.3 or later and Concrete CMS 8 to 8.5.21 or later. Audit Feature, Feature Link, Hero Image, and Image blocks across your site for external link URLs containing unexpected markup or script payloads, and review which accounts hold even single-page editing privileges since that is sufficient to plant the payload. If a malicious payload was found, invalidate all sessions and rotate credentials for privileged users, as viewed pages could have exposed admin sessions.