CVE-2026-81903

Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img tag by a helper that did not encode attribute output, and was rendered raw in the Containers dashboard list and editor views. A user with delegated access to the Page Containers dashboard could store a crafted icon value that broke out of the src attribute and executed script in the authenticated session of another editor or administrator who viewed the list, enabling session token theft and privileged dashboard actions. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.0 with vector CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.

• CWE-79

• https://documentation.concretecms.org/developers/introduction/version-history/953-release-notesBroken Link

Published

Sep 14, 2026

Last Modified

Sep 18, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-81898In Concrete CMS below version 9.5.3, the Address attribute's…7.5
• CVE-2026-81899Concrete CMS 9.0.0 to 9.5.2 stored group folder names withou…7.3
• CVE-2026-8190A vulnerability was determined in Wavlink NU516U1 M16U1_V240…8.8
• CVE-2026-81900Concrete CMS before 9.5.3 applied only trim() to the YouTube…6.1
• CVE-2026-81901In Concrete CMS 9.2.0 through 9.5.2, the REST API page updat…8.7
• CVE-2026-81902Concrete CMS 9 through 9.5.2 did not validate a CSRF token i…8.1
• CVE-2026-81904Concrete CMS below 9.5.3 registered view assets for every su…6.3
• CVE-2026-81905Concrete CMS below 9.5.3 stores user validation hashes for m…6.3
• CVE-2026-81906Concrete CMS OAuth callback login path prior to version 9.5.…6.3
• CVE-2026-81907Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Req…6.1
• CVE-2026-81908Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization …6
• CVE-2026-81909Concrete CMS 9 through 9.5.2 is vulnerable to Missing Author…5.9