CVE-2026-18113

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0 through 9.5.2

Description The Top Navigation Bar block fails to HTML-escape dropdown child page names before rendering them on the page. This allows a user with permissions to create or rename pages to inject a malicious script via a child page name. When a visitor, editor, or administrator opens the affected dropdown, the script executes with the victim's privileges, potentially allowing the attacker to read same-origin content or perform actions available to that user.

Recommendations Update Concrete CMS to a version later than 9.5.2.