Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-81895— Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Injection in Concrete CMS Document Library Block via `fsID[]` in `setMode=any`

Quick assessment

Affected
Concrete CMS Concrete CMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Concrete CMS 9.5.3 之前的版本中，文档库（Document Library）区块在通过 提交文件集标识符时，未将其验证为整数。当该区块配置为 为 时，系统会将每个存储的标识符直接拼接到文件集过滤查询语句中，而没有进行类型转换或作为参数绑定。 因此，一个被允许添加或编辑文档库区块的经过身份验证的用户，可以将 SQL 语法持久化存储在该区块的配置项 中。每当渲染包含该区块的已发布页面时，存储的表达式都会被执行，从而产生基于时间的盲 SQL 注入（Stored, time-based blind S

CVSS 8.5 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81895

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Injection in Concrete CMS Document Library Block via `fsID[]` in `setMode=any`
Source: CVE Program / CVE List V5
Vulnerability Description
In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID[] without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of casting it or binding it as a parameter. An authenticated user permitted to add or edit a Document Library block could therefore persist SQL syntax in the block configuration (btDocumentLibrary.setIds), and that stored expression was executed every time the published page containing the block was rendered, producing stored, time-based blind SQL injection. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 8.5 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Habib Allah for reporting.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Concrete CMS Concrete CMS 5.0.0 ~ 9.5.2 -

II. Public POCs for CVE-2026-81895

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-81895

请登录查看更多情报信息。

Vendor Pages for CVE-2026-81895 (1)

Same Patch Batch · Concrete CMS · 2026-09-15 · 27 CVEs total

CVE-2026-18110 8.7 HIGH Concrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user select
CVE-2026-18111 8.5 HIGH Concrete CMS below 9.5.4 allows privilege escalation because adding users and assigning gr
CVE-2026-81894 8.5 HIGH Concrete CMS 9.5.2 and below is vulnerable to Stored DOM-based Cross-site Scripting (XSS)
CVE-2026-81896 8.4 HIGH Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissi
CVE-2026-81897 7.7 HIGH Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via Express form Text control
CVE-2026-81898 7.5 HIGH Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address att
CVE-2026-18113 7.5 HIGH Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the Top Navigation Bar Block via
CVE-2026-18115 7.4 HIGH In Concrete CMS 9.2.0 to 9.5.2, Missing Authorization in REST API Users update() and chang
CVE-2026-81899 7.3 HIGH Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via group folder name on the Members
CVE-2026-81920 2.3 LOW Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard S
CVE-2026-81921 2.3 LOW In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status
CVE-2026-68532 2.3 LOW Concrete CMS 9.0.0 to 9.5.2 is vunerable to CSRF in Concrete CMS Group Type Deletion Dashb
CVE-2026-68534 2.3 LOW Concrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in
CVE-2026-68533 2.3 LOW Missing Authorization in Concrete CMS versions below 9.5.3 Conversation File Upload Allows
CVE-2026-81919 2.3 LOW Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arran
CVE-2026-81922 2.1 LOW "In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder a
CVE-2026-81924 2.1 LOW Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Theme Page
CVE-2026-81923 2.1 LOW Concrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editor
CVE-2026-18421 2.1 LOW Concrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, a
CVE-2026-68530 2.1 LOW Concrete CMS 9.0.0 through 9.5.2 is Missing Authorization on Board Instance Actions Allowe

Showing top 20 of 27 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Concrete CMS
Same vendor: Concrete CMS
Same weakness: CWE-89

V. Comments for CVE-2026-81895

No comments yet

Leave a comment