---
id: CVE-2026-18113
title: >-
  In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape
  dropdown child page names before writing them into the page, so a user who
  could create or rename pages could store a script through a child page name
  and hav…
summary: >-
  In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape
  dropdown child page names before writing them into the page, so a user who
  could create or rename pages could store a script through a child page name
  and hav…
severity: high
cvss: 7.5
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-79
vendor: Concrete CMS
product: Concrete CMS
affected:
  - concrete_cms >= 9.0.0 <= 9.5.2
published: '2026-09-15'
updated: '2026-09-20'
sourceUpdated: '2026-09-20T01:16:28.450'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-18113'
references:
  - url: >-
      https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes
    label: ff5b8ace-8b95-4078-9743-eac1ca5451de
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-20T00:35:17.660109Z'
cvssSource: cna
epss: 0.00285
epssPercentile: 0.18635
ingestedAt: '2026-09-15T17:41:02.897Z'
---

## Overview

In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could create or rename pages could store a script through a child page name and have it run in the browser of any visitor, editor, or administrator who viewed the navigation and opened the affected dropdown. In the Concrete CMS origin,  the script executed with the victim's privileges and could read same-origin content or perform actions available to that user. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks labixiaoxin97 for reporting.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.