Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name (customAliasName) because the Edit Alias dialog applied… (CVE-2026-18117)
Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name (customAliasName) because the Edit Alias dialog applied only trim() to the submitted value and performed no input neutralization. An authenticated user holding canWrite (editor) permission on a page could store a malicious alias name that was later rendered unescaped in the administrative Sitemap panel, where it executed automatically in any administrator or editor session that opened the panel, allowing an editor to escalate to administrator through the victim's active session. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N. Thanks Nguyen Manh Thuan for reporting.
AI Analysis
Technical Summary
Concrete CMS versions 9.0.0 through 9.5.3 are affected by a stored XSS vulnerability (CVE-2026-18117) in the customAliasName parameter. The Edit Alias dialog applies only a trim() function to user input and does not perform input neutralization, allowing malicious script injection. When an editor with canWrite permission sets a crafted alias name, it is stored and later rendered unescaped in the administrative Sitemap panel. This causes the malicious script to execute automatically in any administrator or editor session that opens the panel, enabling an editor to escalate privileges to administrator by hijacking the victim's active session. The vulnerability has a CVSS v4.0 score of 7.3, indicating high severity.
Potential Impact
An authenticated user with editor-level permissions can inject malicious scripts via the custom page alias name, which execute in the context of administrators or editors viewing the Sitemap panel. This can lead to privilege escalation from editor to administrator by hijacking active sessions, compromising administrative control of the CMS.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict editor permissions carefully and avoid opening the Sitemap panel in sessions with elevated privileges when untrusted editors are active.
Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name (customAliasName) because the Edit Alias dialog applied… (CVE-2026-18117)
Description
Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name (customAliasName) because the Edit Alias dialog applied only trim() to the submitted value and performed no input neutralization. An authenticated user holding canWrite (editor) permission on a page could store a malicious alias name that was later rendered unescaped in the administrative Sitemap panel, where it executed automatically in any administrator or editor session that opened the panel, allowing an editor to escalate to administrator through the victim's active session. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N. Thanks Nguyen Manh Thuan for reporting.
CVSS v4.0
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Concrete CMS versions 9.0.0 through 9.5.3 are affected by a stored XSS vulnerability (CVE-2026-18117) in the customAliasName parameter. The Edit Alias dialog applies only a trim() function to user input and does not perform input neutralization, allowing malicious script injection. When an editor with canWrite permission sets a crafted alias name, it is stored and later rendered unescaped in the administrative Sitemap panel. This causes the malicious script to execute automatically in any administrator or editor session that opens the panel, enabling an editor to escalate privileges to administrator by hijacking the victim's active session. The vulnerability has a CVSS v4.0 score of 7.3, indicating high severity.
Potential Impact
An authenticated user with editor-level permissions can inject malicious scripts via the custom page alias name, which execute in the context of administrators or editors viewing the Sitemap panel. This can lead to privilege escalation from editor to administrator by hijacking active sessions, compromising administrative control of the CMS.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict editor permissions carefully and avoid opening the Sitemap panel in sessions with elevated privileges when untrusted editors are active.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-rwvw-4pc9-743m
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-18117"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6aa8a16155bf5e2cf5f3b719
Added to database: 09/15/2026, 01:37:37 UTC
Last enriched: 09/15/2026, 01:41:16 UTC
Last updated: 09/15/2026, 03:06:58 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.