CVE-2026-81897

Executive Summary

CVE-2026-81897 is a stored cross-site scripting (XSS) vulnerability in the Express entities forms dashboard controller of Concrete CMS versions below 9.5.3. The save_control action fails to validate an anti-CSRF token, allowing a remote, unauthenticated attacker to induce an authenticated administrator to submit a forged cross-site request. This writes attacker-controlled headline and body values to an existing Express form Text control, which are then emitted without output encoding, executing as persistent JavaScript for any administrator who later opens the affected entry.

Technical Analysis

The vulnerability chains two distinct weaknesses: a missing anti-CSRF (Cross-Site Request Forgery) token validation on a state-changing administrative action, and the absence of output encoding on the Express form Text element when rendering stored content. Both elements combine to produce persistent (stored) XSS.

The affected component is the "Express entities forms dashboard controller," specifically its save_control action. In Concrete CMS, the dashboard is the administrative interface. The save_control action persists form-control configuration — in this case, headline and body values for an "Express form Text control." Because the action does not verify an anti-CSRF token, a request to this endpoint originating from a malicious third-party site is processed as if it were a legitimate administrator action, provided the victim administrator is authenticated and their browser sends session credentials automatically.

The description explicitly states the CSRF token validation is absent for this action. This is a classic failure of the synchronizer-token pattern. The consequence is that a remote attacker without credentials can craft a cross-site request that an authenticated administrator is tricked into issuing. Because the request mutates stored data (headline and body of an existing Express form Text control), the effect is durable.

The second half of the chain is the storage and subsequent rendering path. The attacker-controlled headline and body values are stored without neutralization and later emitted without output encoding by the Express form Text element. This means the stored markup is delivered to the browser as executable content rather than inert text. When any administrator subsequently opens the affected entry, the injected JavaScript executes in that administrator's authenticated session context. The result is stored XSS.

The CVSS v4.0 vector reflects this combined mechanism:

• AV:N (Network) — exploitable remotely.
• AC:L (Low) — no special attack complexity beyond delivering a crafted request.
• AT:P (Attack Requirements: Present) — successful exploitation requires a user to be authenticated and to interact with the forged request; the vulnerable state cannot be reached in isolation.
• PR:None — the attacker does not need credentials.
• UI:Passive — the victim administrator must be induced to submit the forged request (passive interaction).
• VC:H / VI:H / VA:H — high confidentiality, integrity, and availability impact to the vulnerable system's scope.
• SC:N / SI:N / SA:N — no subsequent-system impact claimed.

The composite score given by the vendor security team is 7.7, indicating a high-severity issue.

No public proof-of-concept, exploit code, or Nuclei template is currently available. EPSS is 0.00190 (8.9th percentile), indicating low predicted near-term exploitation likelihood, though this metric can change. The CVE is not in CISA KEV.

Exploitation Scenarios

Because no public PoC exists, the following chain is described at the vulnerability-class level, strictly grounded in the NVD description. No internal function names, endpoints, or parameters beyond those in the description (save_control, Express entities forms dashboard controller, Express form Text control, headline, body) are asserted.

1. Reconnaissance / target identification. The attacker identifies a target running Concrete CMS below 9.5.3. Publicly accessible Concrete CMS instances can be fingerprinted (e.g., via static asset paths and administrative login pages). The attacker must also determine the site uses Express entities with at least one existing form Text control, since the flaw writes to an existing control.

2. Triggering the flaw class (CSRF). The attacker constructs a forged cross-site request directed at the save_control action in the Express entities forms dashboard controller. The description states this action does not validate the anti-CSRF token, so the request will be honored if it carries the administrator's ambient authentication (e.g., session cookie). The attacker crafts a page or resource that causes an authenticated administrator's browser to submit this request. Because the CSRF token is not required, the attacker does not need to read or predict any token value.

3. Payload / execution method (stored XSS). Embedded in the forged request are attacker-controlled headline and body values targeted at an existing Express form Text control. When the forged request is processed, these values are persisted. The description states the Express form Text element emitted these values without output encoding, meaning the stored markup is not neutralized. The injected markup is therefore stored as a script payload that executes as JavaScript in the browser context of an administrator who later opens the affected entry.

4. Post-exploitation impact. The JavaScript executes in the session of any administrator viewing the affected entry — a stored (persistent) XSS condition. Per the CVSS subscores, this yields high impact to confidentiality, integrity, and availability of the vulnerable system's scope. In an administrative context, this could enable session/token theft, privileged actions performed as the victim, or configuration tampering — these are generic consequences of authenticated stored XSS and are not asserted as confirmed specifics of this CVE beyond the stated CVSS impacts.

Limitations: The attacker cannot directly force the victim to be authenticated; the attack relies on UI:Passive interaction (the admin submitting/loading the forged request). The vulnerable state requires AT:P (attack requirements present).

Impact Assessment

Exploitation results in stored cross-site scripting executing in authenticated administrator sessions after the victim opens the affected Express form entry. Per CVSS v4.0, the vulnerable-system impacts are high across confidentiality (VC:H), integrity (VI:H), and availability (VA:H), while subsequent-system impacts are none (SC:N/SI:N/SA:N). The business impact includes potential compromise of administrative sessions, defacement or manipulation of stored content, and the ability to execute arbitrary client-side actions under an admin's identity.

Blast radius is scoped to Concrete CMS deployments below 9.5.3 that (a) use Express entities with form Text controls, and (b) have administrators who can be induced to submit the forged request. Because the injection is stored, any administrator opening the poisoned entry is a potential victim, giving the payload a persistent, repeatable execution surface. High-privilege impact elevates the severity for organizations where the Concrete CMS admin console governs public-facing content or further integrations.

Detection Guidance

Sigma Rule

title: Concrete CMS Express Forms save_control CSRF to Stored XSS Attempt
id: 7f9c2e10-4a3b-4d6e-9c1a-cve202681897
status: experimental
description: Detects requests to the Concrete CMS Express entities forms dashboard controller save_control action without a validated anti-CSRF token, consistent with CVE-2026-81897.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-81897
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: apache
detection:
  selection_endpoint:
    cs-uri-stem|contains: 'save_control'
    cs-uri-stem|contains: 'express'
  selection_admin_context:
    cs-uri-stem|contains: '/dashboard/'
  selection_method:
    cs-method: 'POST'
  filter_no_referer:
    cs-referer: null
  filter_cross_site:
    cs-referer|contains: 'concrete'
  condition: selection_endpoint and selection_method and selection_admin_context and not filter_cross_site
fields:
  - c-ip
  - cs-uri-stem
  - cs-referer
  - cs-method
falsepositives:
  - Legitimate dashboard form submissions where referer header is stripped by proxy
level: medium
tags:
  - attack.t1190
  - cve.2026.81897

YARA Rule

rule CVE_2026_81897_ConcreteCMS_Stored_XSS
{
    meta:
        description = "Detects stored XSS payload markers potentially associated with CVE-2026-81897 in Concrete CMS Express form controls"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-81897"
        cve = "CVE-2026-81897"

    strings:
        $a = "save_control" ascii nocase
        $b = "express" ascii nocase
        $c = "headline" ascii nocase
        $d = "body" ascii nocase
        $script1 = "<script" ascii nocase
        $script2 = "onerror=" ascii nocase
        $script3 = "onload=" ascii nocase
        $script4 = "javascript:" ascii nocase

    condition:
        (uint16be(0) == 0x504B or true) and
        ($a or ($b and $c)) and
        any of ($script*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-81897 Concrete CMS Express save_control CSRF Stored XSS Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"save_control"; nocase; http.uri; content:"express"; nocase; http.header; content:"Referer"; negate; content:"<script"; nocase; http.client_body; content:"<script"; nocase; sid:202681897; rev:1; reference:cve,2026-81897; metadata:created_at 2026_01_01, updated_at 2026_01_01; classtype:web-application-attack;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where network.protocol == "http" and http.request.method == "POST"
     and url.path : "*save_control*" and url.path : "*express*"]
  [network where network.protocol == "http" and http.request.method == "POST"
     and url.path : "*dashboard*" and http.request.body.content : ("*<script*" or "*onerror*" or "*javascript:*")]

Splunk SPL Query

index=web sourcetype=access_combined
| search cs_uri_stem="*save_control*" cs_uri_stem="*express*" cs_method="POST"
| eval payload_suspicious=if((match(cs_uri_query, "(?i)<script|<img|onerror|onload|javascript:") OR match(cs_uri_stem, "(?i)<script")), "true", "false")
| stats count values(cs_referer) as referers by src_ip cs_uri_stem payload_suspicious
| where payload_suspicious="true" OR isnull(referers)
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,concrete_cms,">
  <rule id="202681897" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>save_control</match>
    <regex type="pcre2">(?i)(express).*save_control|save_control.*(/dashboard/)</regex>
    <description>CVE-2026-81897 - Possible Concrete CMS Express save_control CSRF/Stored XSS attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,cve_2026_81897,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source; no vendor fix or workaround recorded in the intelligence data. Fix is indicated as Concrete CMS 9.5.3 or above, but this is unverified by tracked sources.

1. Immediate mitigations

   • Restrict access to the Concrete CMS dashboard interface to trusted networks or VPN; the forged request depends on an authenticated administrator session.
   • Deploy a WAF rule that blocks cross-site POST requests to the Express entities forms dashboard save_control action lacking a valid anti-CSRF token or carrying an unexpected Referer.
   • Enforce SameSite=Strict (or Lax) on session cookies to reduce cross-site request forgery viability.
   • Apply strict Content Security Policy (CSP) to the administrative interface to inhibit execution of injected inline script.
   • Reduce reliance on Express form Text controls, or sanitize stored headline/body values at the application layer where feasible.

2. Patch / upgrade steps

   • Upgrade Concrete CMS to 9.5.3 or later as the presumed fix, verifying against the official vendor advisory and release notes before relying on it (tracked patch confidence is 0/4).
   • After upgrade, re-validate that anti-CSRF token checks are present on the save_control action and that Express form Text output is encoded.

3. Long-term hardening

   • Implement and enforce anti-CSRF token validation on all state-changing dashboard actions.
   • Apply context-aware output encoding for all stored content rendered into HTML, especially in administrative views.
   • Adopt a coordinated disclosure and vulnerability-tracking process; monitor the Concrete CMS security advisories channel for the official CVE-2026-81897 entry.
   • Conduct regular authenticated stored-XSS testing against administrative workflows, including CSRF-chained test cases.

References

• NVD — CVE-2026-81897: https://nvd.nist.gov/vuln/detail/CVE-2026-81897
• Concrete CMS security advisories: https://www.concretecms.org/security (recommended for the official vendor advisory)
• CWE-79 — Improper Neutralization of Input During Web Page Generation (XSS): https://cwe.mitre.org/data/definitions/79.html
• CISA KEV Catalog: not applicable — CVE-2026-81897 is not listed in KEV as of this report.
• Reporter attribution: Yonatan Drori (Tenzai), per the CVE description.

Exploit-in-the-wild evidence: none reported; no public PoC, exploit code, or Nuclei template available. EPSS 0.00190 (8.9th percentile). No known threat actor campaign is associated with this CVE in the provided data.