CVE-2026-18113

Concrete CMS versions 9.0 through 9.5.2 fail to HTML-escape child page names rendered in the Top Navigation Bar block's dropdowns, allowing stored cross-site scripting (CWE-79). An attacker needs only the ability to create or rename a page: they place script in the child page's name, and the payload executes in the browser of any visitor, editor, or administrator who views the navigation and opens the affected dropdown. Because the script runs same-origin with the victim's privileges, it can read page content or silently perform any action available to that user, including administrators, effectively turning a limited editor account into full site compromise. Any site on 9.0–9.5.2 using the Top Navigation Bar block — especially those with multiple authors or self-service page creation — is affected. There is no known public proof of concept and no evidence of in-the-wild exploitation.

What to do: Upgrade Concrete CMS to a release later than 9.5.2 as soon as a patched version is available from the vendor. In the interim, restrict who can create or rename pages, and audit existing child page names (especially recently added or renamed ones) for embedded script tags or HTML payloads. Also review site logs and page revision history for suspicious page renames, since a successful payload would have executed against privileged users opening the navigation dropdown.