AI Threat AlertCVE-2026-18117: Concrete CMS: stored XSS in alias name enables privilege escalation
MEDIUMConcrete CMS 9.0.0 through 9.5.3 has a stored cross-site scripting flaw in the custom page alias name field. An editor can plant a script that runs automatically in an administrator's session when the Sitemap panel is opened, which allows escalation from editor to administrator. Exploitation likelihood is low to moderate: EPSS is 0.00142 (the feed lists it in the 97th percentile, which looks inconsistent with that raw score), there is no public exploit, no Nuclei template, it is not in CISA KEV, and CISA SSVC says TRACK. The attacker must already hold authenticated editor rights, and the victim must open the panel. This is a general-purpose CMS rather than an AI/ML product, with no tracked AI package affected, so AI-specific exposure arises only if the CMS fronts AI portals, model documentation, or ML dashboards. Upgrade to Concrete CMS 9.5.4 or later per the vendor release notes (verify the exact fixed version in the vendor advisory), and review editor accounts and existing alias names for injected markup.
What is the risk?
Medium overall. The base CVSS v3.1 score is 5.4, and the vendor rates it 7.3 under CVSS v4.0 because of the confidentiality and integrity impact if an administrator session is hijacked. Exploitation requires an authenticated editor with write permission plus victim interaction (opening the Sitemap panel). There is no known in-the-wild exploitation and no public exploit. The AI/ML relevance is indirect and limited to deployments where Concrete CMS hosts AI-related content or admin access feeds into ML infrastructure.
How does the attack unfold?
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade Concrete CMS to the fixed release (9.5.4 or later; confirm in the vendor release notes). 2) Audit all page alias names for HTML or script content and remove anything suspicious. 3) Review users with editor (canWrite) permissions and remove unnecessary access. 4) Enforce a strict Content-Security-Policy to limit inline script execution and set HttpOnly and SameSite cookie flags. 5) Require MFA for administrators. 6) Monitor admin audit logs for unexpected user or permission changes after Sitemap panel access.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-18117?
Concrete CMS 9.0.0 through 9.5.3 has a stored cross-site scripting flaw in the custom page alias name field. An editor can plant a script that runs automatically in an administrator's session when the Sitemap panel is opened, which allows escalation from editor to administrator. Exploitation likelihood is low to moderate: EPSS is 0.00142 (the feed lists it in the 97th percentile, which looks inconsistent with that raw score), there is no public exploit, no Nuclei template, it is not in CISA KEV, and CISA SSVC says TRACK. The attacker must already hold authenticated editor rights, and the victim must open the panel. This is a general-purpose CMS rather than an AI/ML product, with no tracked AI package affected, so AI-specific exposure arises only if the CMS fronts AI portals, model documentation, or ML dashboards. Upgrade to Concrete CMS 9.5.4 or later per the vendor release notes (verify the exact fixed version in the vendor advisory), and review editor accounts and existing alias names for injected markup.
Is CVE-2026-18117 actively exploited?
No confirmed active exploitation of CVE-2026-18117 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-18117?
1) Upgrade Concrete CMS to the fixed release (9.5.4 or later; confirm in the vendor release notes). 2) Audit all page alias names for HTML or script content and remove anything suspicious. 3) Review users with editor (canWrite) permissions and remove unnecessary access. 4) Enforce a strict Content-Security-Policy to limit inline script execution and set HttpOnly and SameSite cookie flags. 5) Require MFA for administrators. 6) Monitor admin audit logs for unexpected user or permission changes after Sitemap panel access.
What systems are affected by CVE-2026-18117?
This vulnerability affects the following AI/ML architecture patterns: Web-based AI documentation portals, CMS-hosted ML dashboards and landing pages.
What is the CVSS score for CVE-2026-18117?
CVE-2026-18117 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.14%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0012Valid AccountsAML.T0049Exploit Public-Facing ApplicationCompliance Controls Affected
What are the technical details?
Original Advisory
Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name (customAliasName) because the Edit Alias dialog applied only trim() to the submitted value and performed no input neutralization. An authenticated user holding canWrite (editor) permission on a page could store a malicious alias name that was later rendered unescaped in the administrative Sitemap panel, where it executed automatically in any administrator or editor session that opened the panel, allowing an editor to escalate to administrator through the victim's active session. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N. Thanks Nguyen Manh Thuan for reporting.
Exploitation Scenario
A malicious or compromised editor on a Concrete CMS site that publishes AI product documentation edits a page alias and stores a JavaScript payload in the custom alias name. When an administrator later opens the Sitemap panel, the payload runs in their session and creates a new administrator account or modifies content. The attacker then uses admin access to alter published model documentation, inject links, or reach integrated services.
Weaknesses (CWE)
CWE-79Improper Neutralization of Input During Web Page GenerationCWE-79Improper Neutralization of Input During Web Page GenerationCWE-79 — Improper Neutralization of Input During Web Page Generation: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
- [Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NTimeline
Related Vulnerabilities
CVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same attack type: Auth BypassGHSA-vvpj-8cmc-gx3910.0picklescan: security flaw enables exploitation
Same attack type: Auth BypassCVE-2025-282810.0LangChain RequestsToolkit: SSRF exposes cloud metadata
Same attack type: Auth BypassCVE-2025-5376710.0Azure OpenAI: SSRF EoP, no auth required (CVSS 10)
Same attack type: Auth BypassCVE-2026-2603010.0semantic-kernel: Code Injection enables RCE
Same attack type: Auth Bypass