CVE-2026-18119

Concrete CMS versions below 9.5.3 failed to sanitize custom style values entered in the Block Design dialog, allowing injected content to be persisted into page CSS through a DOM sink, resulting in stored cross-site scripting (CWE-79). An attacker with editor-level permissions can craft a malicious custom style that executes script when a higher-privileged user, such as an administrator, views or edits the affected page, hijacking the admin's session and escalating privileges. The Concrete CMS security team rated this CVSS v4.0 7.0 (high), reflecting low attack complexity but the need for editor credentials and some user interaction. All deployments running Concrete CMS prior to 9.5.3 with multiple user accounts (especially editors alongside administrators) are affected. No public proof of concept is known, it is not on the CISA KEV list, and there is no indication of in-the-wild exploitation.

What to do: Upgrade to Concrete CMS 9.5.3 or later, which sanitizes custom style values in the Block Design dialog. Review pages for unexpected or malformed custom style entries added by editor-level accounts, and inspect access logs for anomalous editor activity. In multi-user installations, verify that editor roles are granted only to trusted users and audit recent privilege changes for signs of session hijacking.