---
id: CVE-2026-81899
title: >-
  Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and
  printed them unescaped on the Members > Groups dashboard page, resulting in
  stored cross-site scripting
summary: >-
  Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and
  printed them unescaped on the Members > Groups dashboard page, resulting in
  stored cross-site scripting. The add and edit group-folder handlers stored the
  sub…
severity: high
cvss: 7.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-79
vendor: Concrete CMS
product: Concrete CMS
affected:
  - concrete_cms >= 9.0.0 <= 9.5.2
published: '2026-09-15'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T19:16:15.097'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81899'
references:
  - url: >-
      https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes
    label: ff5b8ace-8b95-4078-9743-eac1ca5451de
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-15T19:18:32.434363Z'
cvssSource: cna
ingestedAt: '2026-09-15T18:41:59.146Z'
epss: 0.00482
epssPercentile: 0.38889
---

## Overview

Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members > Groups dashboard page, resulting in stored cross-site scripting. The add and edit group-folder handlers stored the submitted folder name without neutralizing HTML, and the group search grid returned it without output encoding, so the Groups dashboard rendered the name as live markup. An authenticated user holding the Add Group Folder permission could store a script payload as a folder name that executed in the session of any administrator who viewed the Groups dashboard, enabling session and token theft and any action available in the administrator's context. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Lý Chấn Hưng (hunglyvn) for reporting.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.