---
id: CVE-2026-81897
title: >-
  In Concrete CMS below CMS 9.5.3, the save_control action in the Express
  entities forms dashboard controller did not validate the anti-CSRF token
summary: >-
  In Concrete CMS below CMS 9.5.3, the save_control action in the Express
  entities forms dashboard controller did not validate the anti-CSRF token. By
  causing an authenticated administrator to submit a forged cross-site request,
  a remote a…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'
cwe:
  - CWE-79
  - CWE-352
vendor: concretecms
product: concrete_cms
affected:
  - concrete_cms < 9.5.3
patched:
  - concrete_cms 9.5.3
published: '2026-09-15'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T19:16:52.777'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81897'
references:
  - url: >-
      https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes
    label: ff5b8ace-8b95-4078-9743-eac1ca5451de
tags:
  - nvd
  - cve.org
  - score-dispute
epss: 0.00165
epssPercentile: 0.0508
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-22T18:13:44.548564Z'
scores:
  nvd: 5.4
  cna: 7.7
ingestedAt: '2026-09-15T17:41:02.866Z'
---

## Overview

In Concrete CMS below CMS 9.5.3, the save_control action in the Express entities forms dashboard controller did not validate the anti-CSRF token. By causing an authenticated administrator to submit a forged cross-site request, a remote attacker without credentials could write attacker-controlled headline and body values to an existing Express form Text control. Those values were emitted without output encoding by the Express form Text element, so the injected markup executed as persistent JavaScript for any administrator who later opened the affected entry, resulting in stored cross-site scripting. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.7 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.

## Affected

- `concrete_cms < 9.5.3`

## Remediation

Upgrade past the affected range:

- `concrete_cms 9.5.3`