CVE-2026-81899

Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members > Groups dashboard page, resulting in stored cross-site scripting. The add and edit group-folder handlers stored the submitted folder name without neutralizing HTML, and the group search grid returned it without output encoding, so the Groups dashboard rendered the name as live markup. An authenticated user holding the Add Group Folder permission could store a script payload as a folder name that executed in the session of any administrator who viewed the Groups dashboard, enabling session and token theft and any action available in the administrator's context. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Lý Chấn Hưng (hunglyvn) for reporting.

• CWE-79

• https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes

Published

Sep 15, 2026

Last Modified

Sep 16, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-81893A flaw was found in gdk-pixbuf. When loading a specially cra…4.7
• CVE-2026-81894Concrete CMS 9.5.2 and below is vulnerable to stored DOM-bas…5.4
• CVE-2026-81895In Concrete CMS before 9.5.3, the Document Library block sto…7.2
• CVE-2026-81896Concrete CMS before 9.5.3 does not apply HTML entity encodin…5.4
• CVE-2026-81897In Concrete CMS below CMS 9.5.3, the save_control action in …5.4
• CVE-2026-81898In Concrete CMS below version 9.5.3, the Address attribute's…7.5
• CVE-2026-8190A vulnerability was determined in Wavlink NU516U1 M16U1_V240…8.8
• CVE-2026-81900Concrete CMS before 9.5.3 applied only trim() to the YouTube…6.1
• CVE-2026-81901In Concrete CMS 9.2.0 through 9.5.2, the REST API page updat…8.7
• CVE-2026-81902Concrete CMS 9 through 9.5.2 did not validate a CSRF token i…8.1
• CVE-2026-81903Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Contain…5.4
• CVE-2026-81904Concrete CMS below 9.5.3 registered view assets for every su…6.3