Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. (CVE-2026-81926)
Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaScript inserted each value into the dialog as raw HTML, so a crafted page path executed script in the editor's authenticated browser session. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.0 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
AI Analysis
Technical Summary
Concrete CMS versions 9.4.0 through 9.5.2 fail to escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The check endpoint returns the submitted path unmodified in its JSON response, and client-side JavaScript inserts these values as raw HTML, enabling cross-site scripting (XSS) in the editor's authenticated session. The vulnerability was reported by Yonatan Drori from Tenzai and assigned CVE-2026-81926 with a CVSS v4.0 base score of 2.0.
Potential Impact
An attacker who can submit crafted page paths may execute scripts in the context of an authenticated editor's browser session. This could lead to limited impact such as low-privilege script execution within the CMS editor interface. The CVSS score indicates low severity with partial attack complexity and privileges required.
Mitigation Recommendations
No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid submitting untrusted page paths or restrict editor access to trusted users only.
Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. (CVE-2026-81926)
Description
Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaScript inserted each value into the dialog as raw HTML, so a crafted page path executed script in the editor's authenticated browser session. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.0 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
CVSS v4.0
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Concrete CMS versions 9.4.0 through 9.5.2 fail to escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The check endpoint returns the submitted path unmodified in its JSON response, and client-side JavaScript inserts these values as raw HTML, enabling cross-site scripting (XSS) in the editor's authenticated session. The vulnerability was reported by Yonatan Drori from Tenzai and assigned CVE-2026-81926 with a CVSS v4.0 base score of 2.0.
Potential Impact
An attacker who can submit crafted page paths may execute scripts in the context of an authenticated editor's browser session. This could lead to limited impact such as low-privilege script execution within the CMS editor interface. The CVSS score indicates low severity with partial attack complexity and privileges required.
Mitigation Recommendations
No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid submitting untrusted page paths or restrict editor access to trusted users only.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-994m-pc89-jhp9
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-81926"]
- Database Specific Severity
- LOW
- Cvss Version
- 4.0
Threat ID: 6aaa07d455bf5e2cf5ea26ff
Added to database: 09/16/2026, 03:07:00 UTC
Last enriched: 09/16/2026, 03:16:38 UTC
Last updated: 09/16/2026, 22:01:39 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.