concretecms

Disclosed vulnerabilities where the NVD names concretecms as an affected vendor, highest CVSS first.

1. CRITICAL 9.6CVE-2026-853852026-09-16

   Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on write and rendered it without output encoding on the Dashboard user management page, where Date::getTimezoneDisplayName() returns any non-IANA value unchanged. A stored cross-site…

   concrete cms

   AI risk analysis on Exploit-DB.ai →

2. HIGH 7.1CVE-2026-853872026-09-16

   Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorization validator confirmed only that a token existed, had not e…

   concrete cms

   AI risk analysis on Exploit-DB.ai →

3. MEDIUM 6.5CVE-2026-870282026-09-16

   Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user was authorized to edit, and did not enforce page-view permission before generating page-back…

   concrete cms

   AI risk analysis on Exploit-DB.ai →

4. MEDIUM 6.5CVE-2026-184262026-09-15

   Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation. Because the token is bound to the user and action rather than to a specif…

   concrete cms

   AI risk analysis on Exploit-DB.ai →

5. MEDIUM 6.1CVE-2026-853862026-09-16

   Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. Plain XML uploads were validated by file extension only and stored as publicly accessible files that were served inline from the applic…

   concrete cms

   AI risk analysis on Exploit-DB.ai →

6. MEDIUM 6.1CVE-2026-819262026-09-15

   Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaS…

   concrete cms

   AI risk analysis on Exploit-DB.ai →

7. MEDIUM 5.9CVE-2026-181202026-09-16

   Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpressEntries() permission check applied by the normal dashboard and CSV Export flow. An unauthenticated visitor who knew or d…

   concrete cms

   AI risk analysis on Exploit-DB.ai →

8. MEDIUM 5.4CVE-2026-819272026-09-15

   Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode (concrete.file_manager.images.svg_sanitization.acti…

   concrete cms

   AI risk analysis on Exploit-DB.ai →

9. LOW 2.7CVE-2026-870312026-09-16

   n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /ccm/api/1.0/users, the add() method of concrete/src/Api/Controller/Users.php) did not perform a permission check before creating an account. As a result, any valid OAuth token carry…

   concrete cms

   AI risk analysis on Exploit-DB.ai →