Vulnerability Details CVE-2026-81926
Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaScript inserted each value into the dialog as raw HTML, so a crafted page path executed script in the editor's authenticated browser session. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.0 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 28.7%
CVSS Severity
CVSS v3 Score 6.1
References
Products affected by CVE-2026-81926
-
cpe:2.3:a:concretecms:concrete_cms:9.4.0
-
cpe:2.3:a:concretecms:concrete_cms:9.4.1
-
cpe:2.3:a:concretecms:concrete_cms:9.4.2
-
cpe:2.3:a:concretecms:concrete_cms:9.4.3
-
cpe:2.3:a:concretecms:concrete_cms:9.4.4
-
cpe:2.3:a:concretecms:concrete_cms:9.4.5
-
cpe:2.3:a:concretecms:concrete_cms:9.4.6
-
cpe:2.3:a:concretecms:concrete_cms:9.4.7
-
cpe:2.3:a:concretecms:concrete_cms:9.4.8
-
cpe:2.3:a:concretecms:concrete_cms:9.5.0
-
cpe:2.3:a:concretecms:concrete_cms:9.5.1
-
cpe:2.3:a:concretecms:concrete_cms:9.5.2