Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML attributes… (CVE-2026-81900)
Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML attributes without escaping or integer casting, resulting in stored cross-site scripting. A user with edit_block permission could inject an event handler that executed script for visitors rendering the page, acting with administrative privileges where the victim was an administrator. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks sh4d0byss for reporting.
AI Analysis
Technical Summary
Concrete CMS before version 9.5.3 improperly handles the YouTube block's stored width and height values by applying only trim() without escaping or integer casting. These values are then directly embedded into iframe HTML attributes, enabling stored cross-site scripting (CWE-79). An attacker with edit_block permission can inject event handlers that execute arbitrary scripts when an administrator visits the affected page, leveraging administrative privileges. The vulnerability has a CVSS v4.0 base score of 7.3, indicating a high severity level.
Potential Impact
An attacker with edit_block permission can inject malicious scripts that execute in the context of administrators viewing the affected page. This can lead to administrative privilege abuse, potentially allowing the attacker to perform actions with elevated rights. The vulnerability is a stored XSS affecting the YouTube block's iframe attributes, impacting confidentiality, integrity, and availability as indicated by the CVSS vector.
Mitigation Recommendations
A fix is available in Concrete CMS version 9.5.3. Users should upgrade to version 9.5.3 or later to remediate this vulnerability. No alternative mitigations are provided in the advisory. Patch status is confirmed by the version number indicating the fix.
Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML attributes… (CVE-2026-81900)
Description
Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML attributes without escaping or integer casting, resulting in stored cross-site scripting. A user with edit_block permission could inject an event handler that executed script for visitors rendering the page, acting with administrative privileges where the victim was an administrator. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks sh4d0byss for reporting.
CVSS v4.0
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Concrete CMS before version 9.5.3 improperly handles the YouTube block's stored width and height values by applying only trim() without escaping or integer casting. These values are then directly embedded into iframe HTML attributes, enabling stored cross-site scripting (CWE-79). An attacker with edit_block permission can inject event handlers that execute arbitrary scripts when an administrator visits the affected page, leveraging administrative privileges. The vulnerability has a CVSS v4.0 base score of 7.3, indicating a high severity level.
Potential Impact
An attacker with edit_block permission can inject malicious scripts that execute in the context of administrators viewing the affected page. This can lead to administrative privilege abuse, potentially allowing the attacker to perform actions with elevated rights. The vulnerability is a stored XSS affecting the YouTube block's iframe attributes, impacting confidentiality, integrity, and availability as indicated by the CVSS vector.
Mitigation Recommendations
A fix is available in Concrete CMS version 9.5.3. Users should upgrade to version 9.5.3 or later to remediate this vulnerability. No alternative mitigations are provided in the advisory. Patch status is confirmed by the version number indicating the fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-c87m-38hc-rc4g
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-81900"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6aa8a16055bf5e2cf5f3b6e7
Added to database: 09/15/2026, 01:37:36 UTC
Last enriched: 09/15/2026, 01:40:28 UTC
Last updated: 09/15/2026, 03:13:27 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.