CVE-2026-81897
In Concrete CMS below CMS 9.5.3, the save_control action in the Express entities forms dashboard controller did not validate the anti-CSRF token. By causing an authenticated administrator to submit a forged cross-site request, a remote attacker without credentials could write attacker-controlled headline and body values to an existing Express form Text control. Those values were emitted without output encoding by the Express form Text element, so the injected markup executed as persistent JavaScript for any administrator who later opened the affected entry, resulting in stored cross-site scripting. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.7 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.19%
- CWE
- CWE-352, CWE-79
- Published
- 2026-09-15
- Last modified
- 2026-09-15
Affected products
- Concrete CMS Concrete CMS
Weakness type
Related vulnerabilities
- CVE-2026-19650 — Cross-Site Request Forgery (CSRF) in GitLab
- CVE-2026-46409 — OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution
- CVE-2026-70376 — Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE
- CVE-2026-65471 — WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-57784 — WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-53649 — Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE
- CVE-2026-28164 — WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-52777 — YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize