Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values. (CVE-2026-81910)
Concrete CMS versions 9 through 9.5.2 have a Server-Side Template Injection (SSTI) vulnerability in the Theme Customizer. This occurs because style values submitted via the customizer are interpolated into server-compiled LESS source without proper neutralization, allowing injection of arbitrary LESS directives. An attacker with Theme Customization permission can exploit this to read arbitrary server files and access internal network resources. The compiled CSS cache publicly exposes sensitive data such as database credentials and private keys. The vulnerability has a CVSS v4.0 score of 5.9, indicating medium severity.
AI Analysis
Technical Summary
Concrete CMS 9 through 9.5.2 is vulnerable to SSTI in the Theme Customizer due to unvalidated style values being embedded directly into server-compiled LESS source. Attackers with Theme Customization permission can inject LESS directives to read arbitrary files via PHP stream wrappers and expose sensitive data in publicly served CSS cache files. This leads to disclosure of secrets and potential server-side request forgery. The vulnerability has a CVSS v4.0 score of 5.9, indicating medium severity.
Potential Impact
An attacker with Theme Customization permission can exploit this vulnerability to read arbitrary files on the server, including sensitive information such as database credentials and private keys. The attacker can also perform server-side request forgery to access internal network resources. The exposure of secrets in publicly accessible CSS cache files increases the risk of further compromise.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Theme Customization permissions to trusted users only to reduce the risk of exploitation.
Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values. (CVE-2026-81910)
Description
Concrete CMS versions 9 through 9.5.2 have a Server-Side Template Injection (SSTI) vulnerability in the Theme Customizer. This occurs because style values submitted via the customizer are interpolated into server-compiled LESS source without proper neutralization, allowing injection of arbitrary LESS directives. An attacker with Theme Customization permission can exploit this to read arbitrary server files and access internal network resources. The compiled CSS cache publicly exposes sensitive data such as database credentials and private keys. The vulnerability has a CVSS v4.0 score of 5.9, indicating medium severity.
CVSS v4.0
Affected software
pkg:composer/concretecms/concrete5Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Concrete CMS 9 through 9.5.2 is vulnerable to SSTI in the Theme Customizer due to unvalidated style values being embedded directly into server-compiled LESS source. Attackers with Theme Customization permission can inject LESS directives to read arbitrary files via PHP stream wrappers and expose sensitive data in publicly served CSS cache files. This leads to disclosure of secrets and potential server-side request forgery. The vulnerability has a CVSS v4.0 score of 5.9, indicating medium severity.
Potential Impact
An attacker with Theme Customization permission can exploit this vulnerability to read arbitrary files on the server, including sensitive information such as database credentials and private keys. The attacker can also perform server-side request forgery to access internal network resources. The exposure of secrets in publicly accessible CSS cache files increases the risk of further compromise.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Theme Customization permissions to trusted users only to reduce the risk of exploitation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-77q8-j8j6-95hj
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-81910"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6aa4a03655bf5e2cf5a8741a
Added to database: 09/12/2026, 00:43:34 UTC
Last enriched: 09/12/2026, 01:28:48 UTC
Last updated: 09/12/2026, 01:56:25 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.