Is there a patch available for CVE-2026-8139?

Yes, a patch is available for CVE-2026-8139. Update the affected software to the latest version immediately.

Concrete CMS CVE-2026-8139

Q: What is the CVSS score of CVE-2026-8139?

CVE-2026-8139 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31380 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-05-21 ff5b8ace-8b95-4078-9743-eac1ca5451de

GHSA-pcrh-gj77-j4mw

XSS Concrete Cms

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 22:35 vuln.today

DescriptionCVE.org

Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because updateCollectionAliasExternal bypasses being sanitized. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.0 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

AnalysisAI

Stored XSS in Concrete CMS 9.5.0 and below allows a high-privileged authenticated attacker to inject malicious scripts via the cvName parameter of external-link pages, exploiting a sanitization bypass in the updateCollectionAliasExternal function. The injected payload is persisted server-side and executes in the browser of any user who subsequently views the affected page within the CMS backend. The vendor-assigned CVSS v4.0 score of 2.0 reflects constrained real-world impact: exploitation requires admin-level credentials, prerequisite attack conditions (AT:P), and passive victim interaction, with no public exploit identified at time of analysis.

Technical ContextAI

Concrete CMS is a PHP-based content management system. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), where user-supplied input is written to persistent storage without adequate sanitization and later rendered in browser contexts. The specific function updateCollectionAliasExternal, which processes the cvName field for external-link page collection aliases, lacks or bypasses the sanitization applied elsewhere in the CMS. Stored XSS differs from reflected XSS in that the payload is not transient - it persists until explicitly removed, increasing the window of exposure. The CVSS v4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:P) indicates the attack is network-delivered with low complexity once access is obtained, but requires prerequisite conditions and passive user interaction to complete the exploit chain.

RemediationAI

Upgrade to Concrete CMS 9.5.1, which is confirmed as the patched release per the vendor's official release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes. If immediate patching is not feasible, restrict CMS administrative panel access to trusted IP addresses or VPN-only networks to reduce the attack surface, noting that this does not remediate the underlying sanitization flaw but substantially limits who can trigger it. Additionally, a WAF rule blocking script injection patterns (e.g., angle brackets, javascript: URIs) in the cvName parameter of external-link page requests can serve as a compensating control, though WAF bypasses are possible and this should not substitute for patching. Audit admin account credentials and enable multi-factor authentication to reduce risk from compromised high-privilege accounts.