PT-2026-42774 · Unknown · Concrete Cms

Yonatan Drori · CVE-2026-8353 · Published 2026-05-22 · Updated 2026-05-26

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0 through 9.5.0

Description Stored Cross-Site Scripting (XSS) exists in the Atomik theme. A user with editor privileges can inject arbitrary JavaScript through the page name, which then executes in the context of any authenticated user who visits the affected account pages. This may result in session hijacking, credential theft, unauthorized actions performed on behalf of users, and privilege escalation.

Recommendations Update Concrete CMS to a version later than 9.5.0.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-8353

GHSA-Q9FM-MPG8-8JQM

Affected Products

Concrete Cms

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8353.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8353 · Security Note
• https://osv.dev/vulnerability/GHSA-q9fm-mpg8-8jqm · Vendor Advisory
• https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-8353 · Vendor Advisory
• https://github.com/concretecms/concretecms · Note