Stored Cross-Site Scripting Vulnerability in Concrete CMS by Concrete5

CVE-2026-81927

What is CVE-2026-81927?

A vulnerability in Concrete CMS prior to version 9.5.3 allows for stored cross-site scripting via SVG file uploads. The issue arises when SVG processing is set to reject potentially harmful elements, leading to incomplete sanitization of SVG files. Specifically, while a built-in blocklist checks for script elements and certain event-handler attributes, a critical sanitization process is bypassed, enabling attackers to execute arbitrary JavaScript in users' browsers. This occurs when a user uploads an SVG file, which, if not properly sanitized, executes malicious scripts when accessed. Users are encouraged to upgrade to the latest version to mitigate this risk.

References