CVE-2026-81900

Concrete CMS versions before 9.5.3 fail to escape or integer-cast the stored width and height values of the YouTube block, applying only a trim() before printing them into iframe HTML attributes, which allows stored cross-site scripting. A user with edit_block permission on the YouTube block can inject an event handler (e.g., in the width/height attribute values) that executes attacker-controlled JavaScript in the browser of any visitor rendering the page. If the victim is an administrator, the injected script runs with administrative privileges, enabling actions such as creating new admin accounts or modifying site content and settings. Affected installations are those running Concrete CMS before 9.5.3 where users with edit_block permission are not fully trusted. No public proof of concept is known, the flaw is not in CISA's KEV catalog, and there is no evidence of in-the-wild exploitation at this time.

What to do: Upgrade to Concrete CMS 9.5.3 or later, which escapes/casts the YouTube block's width and height values. Review existing YouTube blocks for unexpected HTML event-handler content in the width and height fields and check block version history for suspicious edits by low-privileged users. Restrict edit_block permissions on pages to trusted staff, since the flaw requires an account with editing rights to exploit, and consider rotating admin sessions if a compromised editor is identified.