CVE-2026-81911— Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary Description
Quick assessment
Affected
Concrete CMS Concrete CMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是该漏洞描述的中文翻译： Concrete CMS 9.0.0 至 9.5.2 版本在“看板自定义插槽（Board Custom Slot）”对话框中易受存储型 XSS（跨站脚本）攻击。 的 端点仅基于目标看板实例的权限（ ）对请求进行授权，随后将客户端提供的 直接原样持久化，而不是在服务端重建内容对象集合，并验证每个项目是否属于该授权看板的数据池。 因此，任何拥有编辑至少一个看板实例内容权限的用户，可以存储一个伪造的摘要对象，其 字段携带含有 JavaScript 的 HTML 负载。由于默认摘要模板在渲染
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Concrete CMS | Concrete CMS | 9.0.0≤ 9.5.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81911
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary Description
Source: CVE Program / CVE List V5
Vulnerability Description
Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The custom_slot save_template endpoint authorizes the request only against the target board instance (canEditBoardContents()) and then persists the client-supplied selectedTemplateOption[collection] verbatim, rather than rebuilding the content object collection server-side and verifying that each item belongs to the authorized board's data pool. A user with permission to edit the contents of at least one board instance can therefore store a forged summary object whose description field carries a JavaScript-bearing HTML payload. The default summary template renders the description field without output encoding, so the payload executes in the browser of any user who views the affected board slot, including anonymous front-end visitors and dashboard users who preview the resulting rule or block. This can enable session or action takeover and escalation toward an administrator. Concrete CMS versions below 9 do not include the Boards feature and are not affected. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.8 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Concrete CMS | Concrete CMS | 9.0.0 ~ 9.5.2 | - |
|
II. Public POCs for CVE-2026-81911
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81911
请登录查看更多情报信息。
Vendor Pages for CVE-2026-81911 (1)
-
🔗 Page Not Found :: Concrete CMS release-notes
Same Patch Batch · Concrete CMS · 2026-09-11 · 10 CVEs total
| CVE-2026-81908 | 6.0 MEDIUM | Missing Authorization in Concrete CMS 9.2.0 to 9.5.2 REST API Groups List Endpoint Allows |
| CVE-2026-18122 | 6.0 MEDIUM | Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entr |
| CVE-2026-68528 | 6.0 MEDIUM | Concrete CMS 9.5.2 and below is vulnerable to Stored XSS in RSS Displayer Block via Unesca |
| CVE-2026-81909 | 5.9 MEDIUM | Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block |
| CVE-2026-81910 | 5.9 MEDIUM | Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in The |
| CVE-2026-81912 | 5.7 MEDIUM | Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple |
| CVE-2026-81913 | 5.3 MEDIUM | Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL pa |
| CVE-2026-68526 | 5.3 MEDIUM | Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog con |
| CVE-2026-81915 | 5.1 MEDIUM | In Concrete CMS below 9.5.3, Page Type update omits object-level authorization |
IV. Related Vulnerabilities
Same product: Concrete CMS
-
CVE-2026-81915
In Concrete CMS below 9.5.3, Page Type update omits object- -
CVE-2026-68526
Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calen -
CVE-2026-81913
Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to -
CVE-2026-81912
Concrete CMS before 9.5.3 is vulnerable to Cross-Site Reques -
CVE-2026-81910
Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Te
Same vendor: Concrete CMS
-
CVE-2026-81915
In Concrete CMS below 9.5.3, Page Type update omits object- -
CVE-2026-68526
Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calen -
CVE-2026-81913
Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to -
CVE-2026-81912
Concrete CMS before 9.5.3 is vulnerable to Cross-Site Reques -
CVE-2026-81910
Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Te
Same weakness: CWE-79
-
CVE-2026-77490
Microsoft Edge (Chromium-based) Spoofing Vulnerability -
CVE-2026-62138
WordPress Visual Composer Website Builder plugin <= 45.16.1 -
CVE-2026-62111
WordPress Simple Payment plugin <= 2.5.4 - Cross Site Script -
CVE-2026-62110
WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scr -
CVE-2026-68528
Concrete CMS 9.5.2 and below is vulnerable to Stored XSS in
V. Comments for CVE-2026-81911
No comments yet