CVE-2026-81896

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-81896

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81896.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-81896

Published

2026-09-15T16:44:40Z

Modified

2026-09-24T03:30:54Z

Severity

8.4 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Label

Details

Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard Form Submissions report (concrete/single_pages/dashboard/reports/forms/legacy.php). a rogue editor could store markup or script in a label that then executes in the browser of any administrator who opens the submissions report for the affected form, producing stored cross-site scripting in the Dashboard. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 8.4 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.

Database specific

{
    "cna_assigner": "ConcreteCMS",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81896.json"
}

References

Affected packages

Git / github.com/concretecms/concretecms

Affected ranges

Type

GIT

Repo

https://github.com/concretecms/concretecms

Events

Introduced

Fixed

9379c29cb26a1054208b37507b6869811aa75a32

Database specific

Show details

{
    "cpe": "cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "5.0.0"
        },
        {
            "last_affected": "9.5.2"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "9.5.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

5.*

5.7.0

5.7.0.1

5.7.0.3

5.7.0.4

5.7.1

5.7.2

5.7.2.1

5.7.3

5.7.3.1

5.7.4.1

5.7.5.2

5.7.5.5

5.7.5.6

5.7.5.7

8.*

8.1.0

8.2.0

8.2.0RC2

8.2.1

8.3.1

8.4.1

9.*

9.3.0

9.3.1

9.3.2

9.3.3

9.3.4

9.3.5

9.3.6

9.3.7

9.4.0

9.4.0RC1

9.4.0RC2

9.4.1

9.4.2

9.4.3

9.4.4

9.5.0

9.5.0RC1

9.5.0RC2

9.5.1

9.5.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81896.json"