CVE-2026-18119 is a stored cross-site scripting flaw in Concrete CMS versions before 9.5.3, rated 9.0 by NVD and 7.0 by the vendor under CVSS 4.0. An editor level user could run script in an administrator's session and escalate privileges. Upgrade to 9.5.3 or later.
What's affected
Concrete CMS below 9.5.3 is affected. The CVE record says 9.5.3 is the release that addresses it, and Concrete's 9.5.3 release notes are the reference.
The attack needs an editor level account, so sites with many editors or shared editor accounts carry more risk.
How to check if you're exposed
Check the version in the dashboard under System and Settings, or from Composer if you manage the site that way:
composer show concretecms/concretecms
Any version below 9.5.3 needs the update. Also list who holds editor permissions and remove accounts that are no longer needed.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads your manifests and lock files, so it will find this package if your own code pulls it in. If Concrete CMS is a Composer dependency in your project, it will show up there.
What to do now
- Back up the site files and database.
- Upgrade Concrete CMS to 9.5.3 or later.
- Review users with edit access to pages and block design, and remove stale accounts.
- Check recently edited pages for custom style values you do not recognize.
Why it matters
The record says custom style values in the Block Design dialog were not sanitized before being written into page CSS through a DOM sink. That is CWE-79, cross-site scripting, in its stored form: the bad value is saved and runs later in another user's browser.
The interesting part is the privilege jump. A low trust editor plants content, and a higher trust administrator triggers it just by viewing the page. NVD scores it 9.0, the vendor 7.0, because the vendor weighs the need for an editor account more heavily. Treat it as serious on any site with untrusted editors. The CVE is not in CISA's KEV list.
Quick check
Why do the scores differ?
NVD gives a CVSS 3.1 score of 9.0. The Concrete security team scored it 7.0 under CVSS 4.0. Both agree an editor can attack an admin.
Do visitors face risk?
The record describes an editor attacking an administrator session, not a general visitor attack.
Sources
Last reviewed: 19 October 2026.
