Vulnerability Description
In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could create or rename pages could store a script through a child page name and have it run in the browser of any visitor, editor, or administrator who viewed the navigation and opened the affected dropdown. In the Concrete CMS origin, the script executed with the victim's privileges and could read same-origin content or perform actions available to that user. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks labixiaoxin97 for reporting.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-18113?
CVE-2026-18113 is a documented vulnerability. In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could create or rename pages could store a scr...
How severe is CVE-2026-18113?
CVSS scoring is not yet available for CVE-2026-18113. Check NVD for updates.
Is there a patch for CVE-2026-18113?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.