Concrete CMS CVE-2026-8353

Exploitation requires the attacker to hold an editor-level account (or higher) within the target Concrete CMS installation - this is reflected in the CVSS 4.0 PR:H metric. The site must be running the Atomik theme; the page name field in other themes is not confirmed vulnerable. The AT:P (attack requirement present) metric further indicates that additional prerequisites beyond baseline access exist. A victim user must be authenticated and must visit a page or account view that renders the crafted page name for the stored payload to execute. Limiting factors: high privilege bar (insider or compromised editor account required), theme-specific exposure (Atomik only), and the victim must be a logged-in user - unauthenticated visitors are not affected.

All available signals converge on low real-world priority. The vendor-assigned CVSS 4.0 score is 2.1, with PR:H (editor-level access required) and AT:P (specific attack prerequisites apply - Atomik theme must be in use). EPSS sits at 0.04% (13th percentile), indicating that exploitation in the near term is statistically unlikely. SSVC confirms exploitation status as 'none' and the attack as not automatable, with only partial technical impact. The high privilege bar (attacker must already hold an editor role, a trusted internal position) substantially limits the realistic threat surface. While the downstream impact - session hijacking, privilege escalation to admin - sounds severe, the prerequisite of controlling an editor account means this is predominantly an insider or account-takeover scenario rather than an opportunistic external attack.

An insider or compromised editor account crafts a page name containing a malicious JavaScript payload (e.g., a cookie-stealing script) and publishes the page through the Atomik theme. When an administrator or other authenticated user later browses to that page or any account view that renders the page name, the script silently fires in their session, exfiltrating their session token to an attacker-controlled endpoint and enabling the attacker to assume their identity. No public exploit code has been identified at the time of analysis.