CVE-2026-81896

Concrete CMS versions before 9.5.3 fail to HTML-entity-encode user-defined Form block question labels when they are rendered as column headers in the Dashboard Form Submissions report (concrete/single_pages/dashboard/reports/forms/legacy.php). An authenticated user with content-editing privileges can store markup or JavaScript in a form question label, which then executes in the browser of any administrator who opens the submissions report for that form. Successful exploitation gives the attacker script execution in the admin's Dashboard context, enabling actions such as session theft or privileged operations performed as the administrator. Any site running Concrete CMS before 9.5.3 that uses the Form block and its submissions report is affected. The Concrete CMS security team rated the flaw CVSS v4.0 8.4 (high); no public proof of concept is known, it is not in CISA's KEV, and there is no indication of in-the-wild exploitation.

What to do: Upgrade Concrete CMS to version 9.5.3 or later, where the question labels are properly HTML-entity-encoded. Until patched, review existing Form block question labels across all forms for unexpected HTML or script content, and restrict form/page editing privileges to trusted users. Check Dashboard access logs and administrator accounts for anomalous activity if any suspicious labels are found.