What’s Vulnerable › Vulnerabilities
CVE-2026-81913: Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter.
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-11 · updated 2026-09-24
- Weakness: CWE-601
Description
Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain that sends a user to an arbitrary external site immediately after authentication, facilitating phishing and credential theft. The same handling is present in the registration flow, giving a second entry point on sites with registration enabled. Concrete CMS versions prior to 9.5.0 do not include the rcURL parameter or this allowlist and are not affected. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Michal M. for reporting.
Affected products
- Concrete CMS: from 9.5.0 before 9.5.3 — fixed in 9.5.3
How to fix
Upgrade to a fixed version: Concrete CMS 9.5.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-81913 or the next vulnerability affects your stack