CVE-2026-8353
Concrete CMS is vulnerable to Stored XSS via page name in the Atomik theme
EPSS 0.15%
Description
Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in the Atomik theme. A rogue editor can inject arbitrary JavaScript that executes in the context of any authenticated user visiting the affected account pages. This can lead to session hijacking, credential theft, malicious actions performed on behalf of users, and potential privilege escalation. Thanks Yonatan Drori (Tenzai) for reporting.
How to fix CVE-2026-8353
To remediate CVE-2026-8353, upgrade the affected package to a fixed version below.
- —upgrade to 9.5.1 or later
Is CVE-2026-8353 being exploited?
Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 9.0.0RC.1, < 9.5.1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |