Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. (CVE-2026-81927)
Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode (concrete.file_manager.images.svg_sanitization.action = reject), uploaded SVGs were checked only against a small built-in blocklist covering the script element and on* event-handler attributes; the broader enshrined/svg-sanitize pass still ran, but its result was discarded, so vectors it would have stripped, such as a javascript: URI in an xlink:href, were stored unmodified and executed when the file was opened directly. A user able to upload files could thereby run arbitrary JavaScript in the browser of any user who viewed the file. The default sanitize mode was not affected. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 1.8 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Oriol Ortiz for reporting.
AI Analysis
Technical Summary
Concrete CMS prior to version 9.5.3 contains a stored XSS vulnerability in SVG file handling under the non-default sanitization setting 'reject files containing potentially harmful elements'. The sanitization process only blocks a limited set of elements and attributes (script elements and on* event handlers) but discards the results of a more comprehensive SVG sanitization pass. Consequently, malicious payloads such as javascript: URIs in xlink:href attributes can be stored and executed in the browser of any user who views the SVG file. This vulnerability requires an authenticated user with file upload permissions and has a CVSS v4.0 base score of 1.8, indicating low severity.
Potential Impact
An authenticated user with file upload permissions can upload a crafted SVG file containing malicious JavaScript that executes in the browsers of users who view the file. This could lead to cross-site scripting attacks with limited impact due to the low CVSS score and required privileges. The default sanitization mode is not vulnerable, limiting exposure to installations using the non-default reject mode.
Mitigation Recommendations
Upgrade Concrete CMS to version 9.5.3 or later, where this vulnerability is fixed. If upgrading is not immediately possible, avoid using the non-default SVG sanitization mode 'reject files containing potentially harmful elements'. Use the default sanitization mode which is not affected by this vulnerability.
Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. (CVE-2026-81927)
Description
Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode (concrete.file_manager.images.svg_sanitization.action = reject), uploaded SVGs were checked only against a small built-in blocklist covering the script element and on* event-handler attributes; the broader enshrined/svg-sanitize pass still ran, but its result was discarded, so vectors it would have stripped, such as a javascript: URI in an xlink:href, were stored unmodified and executed when the file was opened directly. A user able to upload files could thereby run arbitrary JavaScript in the browser of any user who viewed the file. The default sanitize mode was not affected. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 1.8 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Oriol Ortiz for reporting.
CVSS v4.0
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Concrete CMS prior to version 9.5.3 contains a stored XSS vulnerability in SVG file handling under the non-default sanitization setting 'reject files containing potentially harmful elements'. The sanitization process only blocks a limited set of elements and attributes (script elements and on* event handlers) but discards the results of a more comprehensive SVG sanitization pass. Consequently, malicious payloads such as javascript: URIs in xlink:href attributes can be stored and executed in the browser of any user who views the SVG file. This vulnerability requires an authenticated user with file upload permissions and has a CVSS v4.0 base score of 1.8, indicating low severity.
Potential Impact
An authenticated user with file upload permissions can upload a crafted SVG file containing malicious JavaScript that executes in the browsers of users who view the file. This could lead to cross-site scripting attacks with limited impact due to the low CVSS score and required privileges. The default sanitization mode is not vulnerable, limiting exposure to installations using the non-default reject mode.
Mitigation Recommendations
Upgrade Concrete CMS to version 9.5.3 or later, where this vulnerability is fixed. If upgrading is not immediately possible, avoid using the non-default SVG sanitization mode 'reject files containing potentially harmful elements'. Use the default sanitization mode which is not affected by this vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-g2cp-r5qq-w6mj
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-81927"]
- Database Specific Severity
- LOW
- Cvss Version
- 4.0
Threat ID: 6aaa07d355bf5e2cf5ea26fc
Added to database: 09/16/2026, 03:06:59 UTC
Last enriched: 09/16/2026, 03:16:13 UTC
Last updated: 09/16/2026, 09:37:57 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.