CVE-2026-18113
Last modified
CVE-2026-18113 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could create or rename pages could store a script through a child page name and have it run in the browser of any visitor, editor, or administrator who viewed the navigation and opened the affected dropdown. In the Concrete CMS origin, the script executed with the victim's privileges and could read same-origin content or perform actions available to that user. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS estimates a 0.25% chance of exploitation in the next 30 days.
Description
In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could create or rename pages could store a script through a child page name and have it run in the browser of any visitor, editor, or administrator who viewed the navigation and opened the affected dropdown. In the Concrete CMS origin, the script executed with the victim's privileges and could read same-origin content or perform actions available to that user. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks labixiaoxin97 for reporting.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Concrete CMS | Concrete CMS | >= 9.0.0, <= 9.5.2 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-18113?
How severe is CVE-2026-18113?
How do I fix CVE-2026-18113?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-18107A flaw was found in CRIU's handling of restartable sequences…7.8
- CVE-2026-18108Net::SAML2 versions before 0.86 for Perl allow authenticatio…9.8
- CVE-2026-18109The W3 Total Cache plugin for WordPress is vulnerable to Sto…7.2
- CVE-2026-1811A flaw has been found in bolo-blog bolo-solo up to 2.6.4. Th…8.8
- CVE-2026-18110Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an aut…8.7
- CVE-2026-18111Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-s…8.5
- CVE-2026-18115Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit_u…7.4
- CVE-2026-18116Concrete CMS 8.3.0 to 9.5.2 stored calendar event names with…7.3
- CVE-2026-18117Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS…7.3
- CVE-2026-18119Concrete CMS below 9.5.3 did not sanitize custom style value…9
- CVE-2026-1812A vulnerability has been found in bolo-blog bolo-solo up to …9.8
- CVE-2026-18120Concrete CMS before 9.5.3 exposed a legacy Express entry sea…6.3
Are you affected by CVE-2026-18113?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST