CVE-2026-18116

Concrete CMS versions 8.3.0 through 9.5.2 store calendar event names without sanitization and render them unescaped in the dashboard 'Waiting For Me' block used for workflow approval and deletion notifications. A registered user with permission to add events to a calendar governed by an approval workflow can submit an event whose name contains a script payload, which then executes in an administrator's browser when the pending request is displayed. Successful exploitation allows the attacker to run arbitrary script in the admin's session, for example creating a new administrator account and fully compromising the site. The flaw affects any site in the affected version range that uses the calendar add-on with an approval workflow and grants event-creation rights to untrusted contributors. It is scored CVSS v4.0 7.3 (high) by the Concrete CMS security team; no public proof-of-concept exists and no exploitation in the wild has been reported.

What to do: Upgrade Concrete CMS to a release newer than 9.5.2 (or the vendor's patched version for your branch) as soon as possible. In the interim, restrict who can add calendar events, review pending approval queues for event names containing script or HTML payloads before clicking through, and audit user accounts for unexpected administrators. If calendar workflows are unused, disabling the calendar approval workflow removes the attack path.