PT-2026-92395

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery CSRF in the theme page-template activation feature. The Dashboard theme Inspect controller's activate files action created PageTemplate records from attacker-supplied pageTemplates values without validating an anti-CSRF token.A...

CVE-2026-68529: Missing Authorization

Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advancedsearch method in DashboardSelectableExpressEntryListTrait resolved an Express entity directly from a user-supplied entity ID and rendered that entity's entries...

CVE-2026-81895: Improper Neutralization of Special Elements used in an SQL Command

In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of...

CVE-2026-81899: Improper Neutralization of Input During Web Page Generation

Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members Groups dashboard page, resulting in stored cross-site scripting. The add and edit group-folder handlers stored the submitted folder name without neutralizing HTML, and the group...

CVE-2026-81925: Improper Neutralization of Input During Web Page Generation

Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to...

CVE-2026-68532: Cross-Site Request Forgery (CSRF)

Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request forgery. A remote unauthenticated attacker could cause an authenticated user with group type management permission to delete a custom group type. The Concrete...

PT-2026-92129

In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of...

PT-2026-92415

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0.0 through 9.5.2 Description An issue exists during remote file import where the system reuses a host's validated DNS pin across different ports. When multiple remote URLs share the same host, the system retains only t...

PT-2026-93124

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3 Description A stored cross-site scripting issue exists in SVG file handling. When the SVG processing is configured to the non-default mode concrete.file manager.images.svg sanitization.action = reject,...

CVE-2026-68530: Missing Authorization

Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolved a board instance directly from an attacker-supplied instance ID and then viewed, refreshed, regenerated, ...

PT-2026-92166

Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit user properties permissions on the REST API user write endpoints PUT /ccm/api/1.0/users/uID and POST /ccm/api/1.0/users/uID/change password. A user with an update-scoped OAuth token and permission to edit only one non-sensitive field coul...

CVE-2026-18115: Missing Authorization

Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edituserproperties permissions on the REST API user write endpoints PUT /ccm/api/1.0/users/uID and POST /ccm/api/1.0/users/uID/changepassword. A user with an update-scoped OAuth token and permission to edit only one non-sensitive field could...

CVE-2026-68531: Asymmetric Resource Consumption (Amplification)

Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the keyword search filters used by the file manager, file folders, and page list, allowing an authenticated user with editor-level or higher privileges to submit a crafted search containing many single-character wildcards...

PT-2026-92401

Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolved a board instance directly from an attacker-supplied instance ID and then viewed, refreshed, regenerated, ...

CVE-2026-81897: Cross-Site Request Forgery (CSRF)

In Concrete CMS below CMS 9.5.3, the savecontrol action in the Express entities forms dashboard controller did not validate the anti-CSRF token. By causing an authenticated administrator to submit a forged cross-site request, a remote attacker without credentials could write attacker-controlled...

CVE-2026-81922: Missing Authorization

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the sendtotop and sendtobottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the...

CVE-2026-81894: Improper Neutralization of Special Elements used in an SQL Command

Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting XSS via the Gallery block's per-image Caption field because the bundled Magnific Popup lightbox script concrete/js/features/imagery/frontend.js re-parses the attribute-decoded caption as HTML through jQuery's...

CVE-2026-18111: Missing Authentication for Critical Function

Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting XSS in the Feature, Feature Link, Hero Image, and Image blocks and before Concrete 8.5.21 in the feature and Image blocks because the external link URL was insufficiently validated by the link filter and was rendered withou...

CVE-2026-91751: Improper Limitation of a Pathname to a Restricted Directory

Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and newid parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory. Attackers can use traversal sequences in API requests to escape the project entries director...

PT-2026-93112

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0.0 through 9.5.2 Description An issue exists where block-level edit-permission checks are not enforced on the Express Form block's control-management actions. The system relies exclusively on CSRF Cross-Site Request...