CVE-2026-81911

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0.0 through 9.5.2

Description Stored Cross-Site Scripting (XSS) exists in the Board Custom Slot dialog. The 'custom slot save template' endpoint validates requests only against the target board instance using the canEditBoardContents() function and persists the selectedTemplateOption[collection] variable verbatim. Because the server does not verify that each item belongs to the authorized board's data pool, a user with board editing permissions can store a forged summary object containing a JavaScript payload in the description field. The default summary template renders this field without output encoding, allowing the payload to execute in the browsers of users viewing the board slot, including anonymous visitors and dashboard users. This may lead to session takeover, action takeover, or privilege escalation to an administrator.

Recommendations Update Concrete CMS versions 9.0.0 through 9.5.2 to a version newer than 9.5.2.