Is there a patch available for CVE-2026-8353?

Yes, a patch is available for CVE-2026-8353. Update the affected software to the latest version immediately.

Concrete CMS CVE-2026-8353

Q: What is the CVSS score of CVE-2026-8353?

CVE-2026-8353 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31443 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-05-22 ConcreteCMS

GHSA-q9fm-mpg8-8jqm

XSS Privilege Escalation Concrete Cms

2.1

CVSS 4.0 · Vendor: ConcreteCMS

Severity by source

Vendor (ConcreteCMS) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

Requires editor-level access (PR:H) and victim page visit (UI:R); scope changes (S:C) as injected script runs in victim's browser context.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ConcreteCMS).

CVSS VectorVendor: ConcreteCMS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:25 vuln.today

CVE Published

May 22, 2026 - 14:18 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in the Atomik theme. A rogue editor can inject arbitrary JavaScript that executes in the context of any authenticated user visiting the affected account pages. This can lead to session hijacking, credential theft, malicious actions performed on behalf of users, and potential privilege escalation. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.

AnalysisAI

Stored XSS in Concrete CMS 9.0 through 9.5.0 enables a rogue editor to inject persistent JavaScript via the page name field within the Atomik theme, executing in the browser session of any authenticated user who visits the affected pages. Consequences include session hijacking, credential theft, and unauthorized actions performed as the victim - potentially escalating to higher privileges if an administrator is targeted. No active exploitation is confirmed (SSVC: none; EPSS 0.04% at the 13th percentile), and a vendor-released patch is available in version 9.5.1.

Technical ContextAI

Concrete CMS is a PHP-based content management system (CPE: cpe:2.3:a:concrete_cms:concrete_cms:*:*:*:*:*:*:*:*). CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause class - the Atomik theme fails to sanitize or encode the page name field before rendering it in HTML output, allowing arbitrary script content to persist in the database and replay to any user whose browser loads the affected page. Stored XSS is structurally more dangerous than reflected variants because a single injection affects all subsequent visitors without requiring per-victim delivery.

RemediationAI

Upgrade Concrete CMS to version 9.5.1, which addresses this vulnerability per the vendor release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes. If immediate upgrade is not feasible, organizations should audit editor-level accounts to ensure only fully trusted personnel hold that role, since exploitation is entirely gated on editor access. As a secondary control, switching the active theme away from Atomik removes the vulnerable rendering surface while the upgrade is scheduled. Restricting the page name field via a content security policy (CSP) that disallows inline script execution would reduce the impact of any successful injection, though this does not address the root cause.