CVE-2026-81895

Concrete CMS versions before 9.5.3 are vulnerable to a stored, time-based blind SQL injection in the Document Library block. The block stores file-set identifiers submitted via the fsID[] field without validating them as integers, and when configured with setMode 'any' it concatenates those stored values directly into the file-set filter query instead of casting or parameter-binding them. An authenticated attacker with permission to add or edit a Document Library block can persist SQL syntax in the block configuration (btDocumentLibrary.setIds), which is then executed every time the published page is rendered, allowing the attacker to infer or manipulate database contents through time-based blind injection. The vendor rates this High severity at CVSS v4.0 8.5. No public proof of concept is known and there is no evidence of exploitation in the wild.

What to do: Upgrade Concrete CMS to version 9.5.3 or later. Until patched, restrict which authenticated users can add or edit Document Library blocks, and inspect the btDocumentLibrary table's setIds column for any non-integer values that would indicate injected payloads. Review database and page-render logs for anomalously slow queries on pages hosting Document Library blocks, which would be consistent with time-based blind injection attempts.