Concrete CMS vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-85386 Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question.High 7.3 · Sep 16, 2026
• CVE-2026-85385 Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on write and rendered it without output encoding on the Dashboard user management High 7.7 · Sep 16, 2026
• CVE-2026-81899 Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members > Groups dashboard page, resulting in storeHigh 7.3 · Sep 15, 2026
• CVE-2026-81898 In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association viewsHigh 7.5 · Sep 15, 2026
• CVE-2026-18115 Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit_user_properties permissions on the REST API user write endpoints (PUT /ccm/api/1.0/users/{uID} and POHigh 7.4 · Sep 15, 2026
• CVE-2026-18113 In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could High 7.5 · Sep 15, 2026
• CVE-2026-81897 In Concrete CMS below CMS 9.5.3, the save_control action in the Express entities forms dashboard controller did not validate the anti-CSRF token.High 7.7 · Sep 15, 2026
• CVE-2026-81896 Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column headers in the Dashboard High 8.4 · Sep 15, 2026
• CVE-2026-81895 In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID[] without validating them as integers, and when High 8.5 · Sep 15, 2026
• CVE-2026-81894 Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting (XSS) via the Gallery block's per-image Caption field because the bundled MaHigh 8.5 · Sep 15, 2026
• CVE-2026-18111 Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting (XSS) in the Feature, Feature Link, Hero Image, and Image blocks and before Concrete 8High 8.5 · Sep 15, 2026
• CVE-2026-18110 Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete endpoint (/ccm/system/user/autocomplete), which bHigh 8.7 · Sep 15, 2026
• CVE-2026-81900 Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML attributes without escapinHigh 7.3 · Sep 14, 2026
• CVE-2026-18116 Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approval and deletion notifHigh 7.3 · Sep 14, 2026
• CVE-2026-18117 Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name (customAliasName) because the Edit Alias dialog applied only trim() High 7.3 · Sep 14, 2026
• CVE-2026-81903 Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known containHigh 7 · Sep 14, 2026
• CVE-2026-81902 Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action (removeOrphanedBlocks).High 7.1 · Sep 14, 2026
• CVE-2026-81901 In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) did not enforce page-property, page-template, or page-typeHigh 7.2 · Sep 14, 2026
• CVE-2026-18119 Concrete CMS below 9.5.3 did not sanitize custom style values in the Block Design dialog before writing them into page CSS via a DOM sink, permitting stored croHigh 7 · Sep 14, 2026
• CVE-2026-10721 Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the  in Permission, Cache, and Search components.High 8.4 · Jun 10, 2026
• CVE-2026-7888 Concrete CMS below 9.5.3 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the alloweHigh 8.4 · Jun 3, 2026
• CVE-2026-8428 Concrete CMS 9.5.0 and below emits a CSRF token in the local_available_update.php view ($token->output('do_update')) but the corresponding do_update() method inHigh 7.5 · May 21, 2026
• CVE-2026-8426 Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>.High 7.5 · May 21, 2026
• CVE-2026-8421 Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php.High 7.5 · May 21, 2026
• CVE-2026-8417 Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle>.High 7.5 · May 21, 2026