CVE-2026-81903

Concrete CMS versions 9.0.0 through 9.5.2 fail to validate the Page Container icon value submitted via the dashboard, storing attacker-controlled input that is later concatenated unencoded into the src attribute of an img tag in the Containers dashboard list and editor views. A user with delegated access to the Page Containers dashboard can submit a crafted icon value that breaks out of the attribute and executes script in the authenticated session of any editor or administrator who views those screens. Successful exploitation allows session token theft and privileged dashboard actions taken as the victim, impacting confidentiality, integrity, and availability of the CMS. Sites running 9.0.0–9.5.2 with multiple users having dashboard access are affected; the Concrete CMS security team rated the flaw CVSS v4.0 7.0 (high). No public proof of concept or in-the-wild exploitation is known at this time.

What to do: Upgrade to a Concrete CMS release newer than 9.5.2 (the latest 9.x) as soon as it is available. In the interim, restrict Page Containers dashboard permissions to trusted administrators only, and review existing container icon values for injected markup or attribute-breaking payloads. Check dashboard user activity logs for unexpected edits to containers and invalidate sessions/tokens for accounts that may have viewed a tampered Containers list.