Reflected XSS Vulnerability in Concrete CMS by Concrete5

CVE-2026-81925

What is CVE-2026-81925?

Concrete CMS prior to version 9.5.3 contains an issue where it fails to properly neutralize a user-supplied date format while rendering messages within the conversation system. This flaw can lead to reflected cross-site scripting (XSS) attacks, allowing malicious actors to execute arbitrary JavaScript in the browsers of users who are tricked into making crafted POST requests to the conversation view endpoint. The absence of a CSRF token further complicates this vulnerability, as it enables the delivery of the malicious payload via auto-submitting cross-origin POST requests without requiring user authentication. This poses a substantial risk to website security, highlighting the necessity for maintaining updated software versions.

References