CVE-2026-81927 Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...

PT-2026-93124

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3 Description A stored cross-site scripting issue exists in SVG file handling. When the SVG processing is configured to the non-default mode concrete.file manager.images.svg sanitization.action = reject,...