CVE-2026-81897

Concrete CMS versions below 9.5.3 fail to validate the anti-CSRF token on the save_control action of the Express entities forms dashboard controller, allowing a remote, unauthenticated attacker to trick a logged-in administrator into submitting a forged cross-site request. The forged request writes attacker-controlled headline and body values into an existing Express form Text control, which are then rendered without output encoding — so the injected markup executes as persistent JavaScript against any administrator who later views the affected entry. Successful exploitation yields stored cross-site scripting with high impact on confidentiality, integrity, and availability of the CMS (CVSS v4.0 7.7), though it requires social-engineering an authenticated admin and the target site must actually use Express forms with Text controls. All sites running Concrete CMS below 9.5.3 are affected. No public proof-of-concept or in-the-wild exploitation is known, and the issue is not in the CISA KEV catalog.

What to do: Upgrade Concrete CMS to 9.5.3 or later as soon as possible. Until patched, brief administrators not to click untrusted links while logged in, since exploitation requires a forged request from an authenticated admin session. Audit existing Express form entries for injected markup and review logs for unexpected save_control submissions to rule out prior compromise.