CVE-2026-81910 Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values.

Medium 5.9 Published 11 Sep 2026 Updated 11 Sep 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-81910?

CVE-2026-81910 is a medium-severity vulnerability in Concretecms Concrete Cms, published on 11 Sep 2026.

Official description

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer (color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and ImageStyle) are interpolated into server-compiled LESS source without neutralization of LESS syntax, allowing a user with the Theme Customization permission to inject arbitrary LESS directives. By injecting the @import (inline) directive, an attacker can read arbitrary files on the server and reach internal network resources through PHP stream wrappers. The compiled output, including any disclosed file contents, is written to the site's publicly served CSS cache, exposing database credentials, private keys, and other application secrets, and enabling server-side request forgery. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.9 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.

Weakness: CWE-1336

Which versions are affected by CVE-2026-81910?

It affects 1 product.

Products include Concretecms Concrete Cms.

How do I fix CVE-2026-81910?

No fix has been published for CVE-2026-81910 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-81910 being exploited?

There is no known exploitation of CVE-2026-81910 in the wild and no public exploit code.

All Concretecms Concrete Cms vulnerabilities

Sources

Also known as GHSA-77q8-j8j6-95hj.