CVE-2026-81925

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3

Description Improper neutralization of a user-supplied custom date format when rendering conversation messages leads to reflected cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites. An attacker can execute arbitrary JavaScript in a user's browser by tricking them into submitting a crafted POST request to the conversation view endpoint. This is facilitated by the absence of a Cross-Site Request Forgery (CSRF) token—a unique identifier used to prevent unauthorized commands from being transmitted from a user the web application trusts—on the endpoint, allowing the payload to be delivered via an auto-submitting cross-origin POST without authentication.

Recommendations Update Concrete CMS to version 9.5.3.