SQL Injection Flaw in Concrete CMS Document Library by Concrete Solutions

CVE-2026-81895

What is CVE-2026-81895?

In versions of Concrete CMS prior to 9.5.3, a serious SQL injection vulnerability exists in the Document Library block. The block improperly handles file-set identifiers submitted through fsID[], failing to validate these inputs as integers. When the block is set to allow any mode, it directly concatenates these unvalidated identifiers into an SQL query for filtering file-sets, enabling an authenticated user to inject and execute malicious SQL commands. The implications of this flaw are significant, as it allows for stored and time-based blind SQL injection attacks, potentially compromising the integrity and security of the application.

References