CVE-2026-68531— Concrete CMS below 9.5.3 is vulnerable to Authenticated Denial of Service via Unescaped SQL LIKE Wildcards in Keyword Search
Quick assessment
Affected
Concrete CMS Concrete CMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Concrete CMS 9 在 9.5.3 版本之前未对文件管理器、文件文件夹和页面列表中所使用的关键词搜索过滤器里的 SQL LIKE 通配符进行转义处理。这使得拥有编辑权限或更高权限的认证用户可以提交包含大量单字符通配符（如 或 ）的恶意搜索请求。由于关键词输入在未经中和其通配符元字符的情况下直接插入 LIKE 子句，即使是一个简短的请求也可能迫使数据库扫描并评估所有行，从而触发全表扫描。重复发送或包含密集通配符的搜索请求可维持较高的数据库 CPU 和 I/O 负载，导致在大型部署环境中其他用户的响应速度下降
Possible ATT&CK Techniques 1 AI
T1110 · Brute ForceAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Concrete CMS | Concrete CMS | 9.0.0≤ 9.5.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-68531
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Concrete CMS below 9.5.3 is vulnerable to Authenticated Denial of Service via Unescaped SQL LIKE Wildcards in Keyword Search
Source: CVE Program / CVE List V5
Vulnerability Description
Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the keyword search filters used by the file manager, file folders, and page list, allowing an authenticated user with editor-level or higher privileges to submit a crafted search containing many single-character wildcards. Because the keyword input was placed into the LIKE clause without neutralizing its wildcard metacharacters, a short request could force the database to evaluate every row and perform a full-table scan, and repeated or wildcard-dense searches could sustain elevated database CPU and I/O, degrading responsiveness for other users on large installations. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N. Thanks noivan for reporting.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不对称的资源消耗(放大攻击)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Concrete CMS | Concrete CMS | 9.0.0 ~ 9.5.2 | - |
|
II. Public POCs for CVE-2026-68531
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-68531
请登录查看更多情报信息。
Vendor Pages for CVE-2026-68531 (1)
-
🔗 Page Not Found :: Concrete CMS release-notes
Same Patch Batch · Concrete CMS · 2026-09-15 · 31 CVEs total
| CVE-2026-18110 | 8.7 HIGH | Concrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user select |
| CVE-2026-81894 | 8.5 HIGH | Concrete CMS 9.5.2 and below is vulnerable to Stored DOM-based Cross-site Scripting (XSS) |
| CVE-2026-18111 | 8.5 HIGH | Concrete CMS below 9.5.4 allows privilege escalation because adding users and assigning gr |
| CVE-2026-81895 | 8.5 HIGH | Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Injection in Concrete CMS Documen |
| CVE-2026-81896 | 8.4 HIGH | Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissi |
| CVE-2026-81897 | 7.7 HIGH | Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via Express form Text control |
| CVE-2026-81898 | 7.5 HIGH | Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address att |
| CVE-2026-18113 | 7.5 HIGH | Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the Top Navigation Bar Block via |
| CVE-2026-18115 | 7.4 HIGH | In Concrete CMS 9.2.0 to 9.5.2, Missing Authorization in REST API Users update() and chang |
| CVE-2026-81899 | 7.3 HIGH | Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via group folder name on the Members |
| CVE-2026-68533 | 2.3 LOW | Missing Authorization in Concrete CMS versions below 9.5.3 Conversation File Upload Allows |
| CVE-2026-81921 | 2.3 LOW | In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status |
| CVE-2026-81920 | 2.3 LOW | Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard S |
| CVE-2026-68532 | 2.3 LOW | Concrete CMS 9.0.0 to 9.5.2 is vunerable to CSRF in Concrete CMS Group Type Deletion Dashb |
| CVE-2026-68534 | 2.3 LOW | Concrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in |
| CVE-2026-81919 | 2.3 LOW | Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arran |
| CVE-2026-81922 | 2.1 LOW | "In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder a |
| CVE-2026-81925 | 2.1 LOW | Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Convers |
| CVE-2026-18424 | 2.1 LOW | Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import |
| CVE-2026-18425 | 2.1 LOW | IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateD |
Showing top 20 of 31 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Concrete CMS
-
CVE-2026-81927
Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SV -
CVE-2026-18426
Concrete CMS 9.0.0 to 9.5.2 Express Form block missing autho -
CVE-2026-81926
Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site -
CVE-2026-81925
Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Si -
CVE-2026-18425
IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap r
Same vendor: Concrete CMS
-
CVE-2026-81927
Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SV -
CVE-2026-18426
Concrete CMS 9.0.0 to 9.5.2 Express Form block missing autho -
CVE-2026-81926
Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site -
CVE-2026-81925
Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Si -
CVE-2026-18425
IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap r
Same weakness: CWE-405
-
CVE-2026-87011
Open WebUI: Unauthenticated requests can stall the server vi -
CVE-2026-86432
commonmark 2.0.0 before 2.8.4 Denial of Service via XML -
CVE-2026-84310
pypdf: Possible long runtimes/large memory usage when retrie -
CVE-2026-54874
Excessive Memory Use Buffering DTLS Records for a Future Epo -
CVE-2026-23934
Frontend DoS via the validate.api.exists action
V. Comments for CVE-2026-68531
No comments yet