EUVD-2026-78205

Concrete CMS before 9.5.3 applied only trim to the YouTube block's stored width and height values and printed them into iframe HTML attributes without escaping or integer casting, resulting in stored cross-site scripting. A user with editblock permission could inject an event handler that execute...

EUVD-2026-78161

Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name customAliasName because the Edit Alias dialog applied only trim to the submitted value and performed no input neutralization. An authenticated user holding canWrite editor permission on a page could store ...

EUVD-2026-78202

Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approval and deletion notifications shown in the dashboard "Waiting For Me" block. A registered user permitted to add events to a calendar governed by an approval...

CVE-2026-18426: Missing Authorization

Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation. Because the token is bound to the user and action rather than to a specific block, page, or form, an...

PT-2026-92189

Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members Groups dashboard page, resulting in stored cross-site scripting. The add and edit group-folder handlers stored the submitted folder name without neutralizing HTML, and the group...

PT-2026-92515

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3 Description Improper neutralization of a user-supplied custom date format when rendering conversation messages leads to reflected cross-site scripting XSS, a technique where malicious scripts are injected...

PT-2026-92374

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0.0 through 9.0.0 Description The dashboard group type controller fails to validate a CSRF Cross-Site Request Forgery token during its delete action. This allows a remote unauthenticated attacker to trick an authenticat...

PT-2026-92180

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3 Description Stored Cross-Site Scripting XSS is possible in Express association views due to the Address attribute's country-less text formatter skipping HTML-escaping. This occurs when a non-required Addres...

PT-2026-92390

Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint the arrange action of ConcreteControllerBackendPageArrangeBlocks. The action enforced page-edit authorization but performed no token check, and its route accepted any HTTP method, so an attacker...

PT-2026-92393

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the send to top and send to bottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the...

CVE-2026-18424: Server-Side Request Forgery (SSRF)

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first ValidatedRemoteUrl is retained and reused for every later URL with that host. A...

PT-2026-92122

Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting XSS in the Feature, Feature Link, Hero Image, and Image blocks and before Concrete 8.5.21 in the feature and Image blocks because the external link URL was insufficiently validated by the link filter and was rendered withou...

CVE-2026-68533: Missing Authorization

Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message Attachments" permission, which was only checked after the file had been stored. A user denied that permission, or an unauthenticated visitor on a guest-postin...

PT-2026-92375

Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message Attachments" permission, which was only checked after the file had been stored. A user denied that permission, or an unauthenticated visitor on a guest-postin...

CVE-2026-81920: Cross-Site Request Forgery (CSRF)

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset controller action cleared the administrator-configured reserved-word list concrete.seo.excludewords but did not validate the anti-CSRF token that the reset modal emitted, and ...

CVE-2026-81922: Missing Authorization

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the sendtotop and sendtobottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the...

CVE-2026-18422: Missing Authorization

Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action Backend\Page\Multilingual::assign. As a result, an authenticated user who held the Edit Page Multilingual Settings permission on a...

PT-2026-92399

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, update data source, and delete data source, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the...

CVE-2026-81921: Missing Authorization

Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...

PT-2026-91772

Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new id parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory. Attackers can use traversal sequences in API requests to escape the project entries directo...