CVE-2026-18117

Concrete CMS versions 9.0.0 through 9.5.3 contain a stored cross-site scripting vulnerability (CWE-79) in the Edit Alias dialog: the submitted custom alias name (customAliasName) was only passed through trim() with no escaping or neutralization before being stored and later rendered unescaped in the administrative Sitemap panel. An authenticated attacker with canWrite (editor) permission on a page can save a malicious alias name, which then executes automatically as script in the browser of any administrator or editor who opens the Sitemap panel. Because the payload runs in a privileged administrative session, a low-privileged editor can hijack that session and effectively escalate to administrator, with high impact on confidentiality and integrity of the site (CVSS v4.0: 7.3, high). Any site running Concrete CMS 9.0.0–9.5.3 that grants editing rights to semi-trusted users is affected. No public proof of concept is known, the flaw is not on the CISA KEV list, and there is no indication of in-the-wild exploitation at this time.

What to do: Upgrade Concrete CMS to the latest 9.x release newer than 9.5.3, where the alias name is properly neutralized. Until patched, review existing page alias names in the Sitemap for injected script, and restrict canWrite/editor permissions to trusted users only, since the vulnerability requires authenticated editor-level access to plant the payload. Check web and CMS audit logs for suspicious customAliasName submissions or unexpected administrative sessions.