---
id: CVE-2026-81911
title: >-
  Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board
  Custom Slot dialog
summary: >-
  Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board
  Custom Slot dialog. The custom_slot save_template endpoint authorizes the
  request only against the target board instance (canEditBoardContents()) and
  then persists…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: concretecms
product: concrete_cms
affected:
  - 'concrete_cms >= 9.0.0, < 9.5.3'
patched:
  - concrete_cms 9.5.3
published: '2026-09-11'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T19:00:06.357'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81911'
references:
  - url: >-
      https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes
    label: ff5b8ace-8b95-4078-9743-eac1ca5451de
tags:
  - nvd
  - cve.org
epss: 0.00237
epssPercentile: 0.13165
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-11T19:32:11.209005Z'
scores:
  nvd: 5.4
  cna: 5.8
ingestedAt: '2026-09-14T00:35:28.533Z'
---

## Overview

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The custom_slot save_template endpoint authorizes the request only against the target board instance (canEditBoardContents()) and then persists the client-supplied selectedTemplateOption[collection] verbatim, rather than rebuilding the content object collection server-side and verifying that each item belongs to the authorized board's data pool. A user with permission to edit the contents of at least one board instance can therefore store a forged summary object whose description field carries a JavaScript-bearing HTML payload. The default summary template renders the description field without output encoding, so the payload executes in the browser of any user who views the affected board slot, including anonymous front-end visitors and dashboard users who preview the resulting rule or block. This can enable session or action takeover and escalation toward an administrator. Concrete CMS versions below 9 do not include the Boards feature and are not affected. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.8 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N. Thanks riodrwn for reporting.

## Affected

- `concrete_cms >= 9.0.0, < 9.5.3`

## Remediation

Upgrade past the affected range:

- `concrete_cms 9.5.3`