concrete cms vulnerabilities and fixes

Recent CVEs affecting concrete cms, with upgrade or downgrade steps. 44 tracked.

Also searched as: concretecms.

concrete cms has 44 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 44. Most recent: 2026-09-16. Highest priority: CVE-2026-18110 (score 50/100).

• CVE-2026-18111 MEDIUM 6.1 UPGRADE Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting (XSS) in the Feature, Feature Link,
• CVE-2026-18117 MEDIUM 5.4 UPGRADE Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name (customAliasName)
• CVE-2026-68526 MEDIUM 4.3 UPGRADE Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controlle
• CVE-2026-81912 MEDIUM 5.7 UPGRADE Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature
• CVE-2026-81913 MEDIUM 6.1 UPGRADE Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter
• CVE-2026-81915 MEDIUM 5.3 UPGRADE Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated
• CVE-2026-68535 MEDIUM 4.3 UPGRADE Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type control
• CVE-2026-81907 HIGH 7.1 UPGRADE Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express "Clear Entries"
• CVE-2026-81897 MEDIUM 5.4 UPGRADE In Concrete CMS below CMS 9.5.3, the save_control action in the Express entities forms dashboard controller di
• CVE-2026-81896 MEDIUM 5.4 UPGRADE Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when
• CVE-2026-81895 HIGH 7.2 UPGRADE In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsI
• CVE-2026-81894 MEDIUM 5.4 UPGRADE Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting (XSS) via the Gallery bloc
• CVE-2026-18110 HIGH 7.5 UPGRADE Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete
• CVE-2026-81925 MEDIUM 6.1 UPGRADE Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversatio
• CVE-2026-18426 MEDIUM 6.5 UPGRADE Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block
• CVE-2026-81926 MEDIUM 6.1 UPGRADE Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location pan
• CVE-2026-85385 CRITICAL 9.6 UPGRADE Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on write and rendered it without
• CVE-2026-85386 MEDIUM 6.1 UPGRADE Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-up
• CVE-2026-87028 MEDIUM 6.5 UPGRADE Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview en
• CVE-2026-87031 LOW 2.7 UPGRADE n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /ccm/api/1.0/users, the add() me
• CVE-2026-18120 MEDIUM 5.9 UPGRADE Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON witho
• CVE-2026-85387 HIGH 7.1 UPGRADE Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-che
• CVE-2026-18425 LOW 2.7 UPGRADE Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashb
• CVE-2026-18424 HIGH 7.1 UPGRADE Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port re
• CVE-2026-18423 HIGH 7.1 UPGRADE Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express save
• CVE-2026-18422 MEDIUM 6.5 UPGRADE Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF t
• CVE-2026-81924 MEDIUM 6.5 UPGRADE Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activa
• CVE-2026-18116 MEDIUM 6.1 UPGRADE Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML es
• CVE-2026-18119 CRITICAL 9.0 UPGRADE Concrete CMS below 9.5.3 did not sanitize custom style values in the Block Design dialog before writing them i
• CVE-2026-81901 HIGH 8.7 UPGRADE In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) did not
• CVE-2026-81902 HIGH 8.1 UPGRADE Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action (removeO
• CVE-2026-81903 MEDIUM 5.4 UPGRADE Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard with
• CVE-2026-81911 MEDIUM 5.4 UPGRADE Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog
• CVE-2026-81921 MEDIUM 5.4 UPGRADE Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream Leagu
• CVE-2026-81922 LOW 2.7 UPGRADE Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitema
• CVE-2026-81923 LOW 2.7 UPGRADE In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions bef
• CVE-2026-81920 MEDIUM 4.3 UPGRADE Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page
• CVE-2026-81919 MEDIUM 4.3 UPGRADE Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint (the ar
• CVE-2026-81916 MEDIUM 4.3 UPGRADE Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity
• CVE-2026-81917 MEDIUM 5.4 UPGRADE Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rend
• CVE-2026-81927 MEDIUM 5.4 UPGRADE Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling
• CVE-2026-81918 MEDIUM 4.8 UPGRADE Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display b
• CVE-2026-81900 MEDIUM 6.1 UPGRADE Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printe
• CVE-2026-81910 MEDIUM 6.5 UPGRADE Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Un

FAQ

How do I fix concrete cms vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is concrete cms being exploited right now?

None of the tracked concrete cms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which concrete cms CVE should I patch first?

CVE-2026-18110 currently ranks highest (50/100): Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete.

RSS feed for concrete cms · ← Back to latest CVEs