Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting (XSS) via the Gallery block's per-image Caption field because… (CVE-2026-81894)
Concrete CMS versions 9.5.2 and earlier contain a stored DOM-based Cross-site Scripting (XSS) vulnerability in the Gallery block's per-image Caption field. This occurs because the bundled Magnific Popup lightbox script improperly handles caption content by parsing it as HTML via jQuery's .append() method instead of inserting it as plain text. A user with page edit permissions can inject malicious scripts into image captions, which execute in the browsers of visitors who open the affected image lightbox.
AI Analysis
Technical Summary
Concrete CMS 9.5.2 and below are vulnerable to stored DOM-based XSS via the Gallery block's per-image Caption field. The vulnerability arises from the bundled Magnific Popup lightbox script (concrete/js/features/imagery/frontend.js) re-parsing the attribute-decoded caption as HTML through jQuery's .append() in the titleSrc function rather than inserting it as text. This allows a user with permission to edit a page containing a Gallery block to store a caption that executes arbitrary scripts in the browser of any visitor who opens that image's lightbox. The vulnerability has a CVSS v3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) and was assigned CVE-2026-81894.
Potential Impact
An attacker with edit permissions on a page containing a Gallery block can inject malicious scripts into image captions. These scripts execute in the context of any visitor who views the image lightbox, potentially leading to theft of sensitive information, session hijacking, or other client-side impacts. The vulnerability requires the attacker to have page edit privileges and user interaction (opening the lightbox). There is no indication of known exploits in the wild.
Mitigation Recommendations
No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict page edit permissions to trusted users only to prevent injection of malicious captions. Avoid opening image lightboxes from untrusted sources.
Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting (XSS) via the Gallery block's per-image Caption field because… (CVE-2026-81894)
Description
Concrete CMS versions 9.5.2 and earlier contain a stored DOM-based Cross-site Scripting (XSS) vulnerability in the Gallery block's per-image Caption field. This occurs because the bundled Magnific Popup lightbox script improperly handles caption content by parsing it as HTML via jQuery's .append() method instead of inserting it as plain text. A user with page edit permissions can inject malicious scripts into image captions, which execute in the browsers of visitors who open the affected image lightbox.
CVSS v3.1
Score 5.4medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Concrete CMS 9.5.2 and below are vulnerable to stored DOM-based XSS via the Gallery block's per-image Caption field. The vulnerability arises from the bundled Magnific Popup lightbox script (concrete/js/features/imagery/frontend.js) re-parsing the attribute-decoded caption as HTML through jQuery's .append() in the titleSrc function rather than inserting it as text. This allows a user with permission to edit a page containing a Gallery block to store a caption that executes arbitrary scripts in the browser of any visitor who opens that image's lightbox. The vulnerability has a CVSS v3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) and was assigned CVE-2026-81894.
Potential Impact
An attacker with edit permissions on a page containing a Gallery block can inject malicious scripts into image captions. These scripts execute in the context of any visitor who views the image lightbox, potentially leading to theft of sensitive information, session hijacking, or other client-side impacts. The vulnerability requires the attacker to have page edit privileges and user interaction (opening the lightbox). There is no indication of known exploits in the wild.
Mitigation Recommendations
No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict page edit permissions to trusted users only to prevent injection of malicious captions. Avoid opening image lightboxes from untrusted sources.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qgxh-7qc6-mgwq
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-81894"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6aade4ea55bf5e2cf5ed9f0d
Added to database: 09/19/2026, 01:27:06 UTC
Last enriched: 09/19/2026, 01:34:23 UTC
Last updated: 09/19/2026, 02:01:07 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.