CVE-2026-81927

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3

Description A stored cross-site scripting issue exists in SVG file handling. When the SVG processing is configured to the non-default mode concrete.file manager.images.svg sanitization.action = reject, uploaded SVGs are only validated against a limited blocklist of script elements and on* event-handler attributes. Because the results of the more comprehensive enshrined/svg-sanitize process are discarded, malicious vectors such as javascript: URIs within an xlink:href attribute are stored without modification. This allows a user with file upload permissions to execute arbitrary JavaScript in the browser of any user who opens the affected file directly.

Recommendations Update to version 9.5.3 or later. As a temporary mitigation, avoid setting the concrete.file manager.images.svg sanitization.action variable to reject.