Cross-Site Scripting Vulnerability in Concrete CMS by Concrete5

CVE-2026-81903

What is CVE-2026-81903?

Concrete CMS versions 9.0.0 to 9.5.2 contain a vulnerability where the Page Container icon value submitted through the dashboard is stored without proper validation. This allows a user with delegated access to potentially craft an icon that executes a malicious script in the session of another editor or administrator. Such an exploitation could lead to unauthorized session token theft and enable the perpetrator to perform actions with elevated privileges within the dashboard. This poses a significant risk to the integrity and security of user accounts and should be addressed promptly.

References