Stored Cross-Site Scripting Vulnerability in Concrete CMS Dashboard Reporting

CVE-2026-81896

What is CVE-2026-81896?

In Concrete CMS versions prior to 9.5.3, a vulnerability exists whereby user-defined Form block question labels do not have HTML entity encoding applied when displayed as column headers in the Dashboard Form Submissions report. This oversight allows a malicious user to inject markup or scripts into a label, which can execute in the browsers of administrators viewing the submissions report. This could lead to stored cross-site scripting attacks, potentially compromising the security of affected systems.

References