CVE-2026-18117

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0.0 through 9.5.3

Description Stored Cross-Site Scripting (XSS) occurs because the Edit Alias dialog only applies the trim() function to submitted values without performing proper input neutralization. An authenticated user with canWrite (editor) permissions can store a malicious value in the customAliasName variable. This value is later rendered unescaped in the administrative Sitemap panel, executing automatically during an administrator or editor session. This flaw allows an editor to escalate their privileges to administrator by leveraging the victim's active session.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.