CVE-2026-81898

Concrete CMS versions below 9.5.3 fail to HTML-escape the Address attribute's country-less text formatter, allowing stored cross-site scripting in Express association views. A low-privileged user who can submit a form containing an Address attribute (which, when not required, accepts a blank country) can inject script that executes in the session of any dashboard user who opens the affected entry, because templates such as concrete/elements/express/form/view/dashboard/association.php echo the association label mask without applying h(). Successful exploitation lets the attacker perform actions with the dashboard user's privileges, potentially full site administration. The Concrete CMS security team rated it CVSS v4.0 7.5 (high), and exploitation requires user interaction plus an attacker with submission rights. No public proof of concept or observed in-the-wild exploitation is known at this time.

What to do: Upgrade Concrete CMS to version 9.5.3 or later, where the formatter escapes output. Until patched, restrict which users can submit forms containing Address attributes and review existing Express entries with Address attributes for injected script. Check dashboard access logs for suspicious activity by low-privilege submitters and invalidate sessions for admins who viewed suspect entries.