CVE-2026-81895 is a high severity (CVSS 7.2 in the record) stored SQL injection flaw in the Document Library block of Concrete CMS before version 9.5.3. A user who may add or edit the block can persist SQL syntax that runs whenever the page renders. Upgrade to 9.5.3 or later.
What's affected
- Concrete CMS versions before 9.5.3, per the CVE record.
- Fixed in 9.5.3. The release notes page linked from the record returned a not found page when we fetched it, so confirm the fix in the Concrete CMS release notes.
- Affected setup: a Document Library block configured with the setMode option set to any, edited by a user with permission to add or edit the block.
Record severity: CVSS 7.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-89, SQL Injection.
Source note: Severity differs by scoring system in the record itself. The CVSS 3.1 score is 7.2 (High), while the Concrete CMS security team gave CVSS v4.0 8.5. Both are high. The fix is the same.
How to check if you're exposed
In the Concrete CMS dashboard, open the system information page, or check the version in your composer lock file. If it is lower than 9.5.3, it is in range. Then list pages that use the Document Library block and the users with permission to add or edit blocks.
What to do now
- Read the Concrete CMS version of each site.
- Upgrade to 9.5.3 or later and test the site.
- Review which editors can add or edit Document Library blocks.
- Inspect existing Document Library block settings for unexpected values in the file set identifiers.
- Back up the database before the upgrade.
Why it matters
SQL injection (CWE-89) occurs when input is joined into a database query instead of being cast or bound as a parameter. In this case the record says the identifiers sent from the form were stored without checking that they were integers, and later joined into a filter query. Because the bad value is stored, the query runs each time the page is shown, which the record describes as time based blind injection.
The attacker needs permission to edit blocks, so the exposure is mainly through editor accounts. Those accounts are often shared widely. The record does not mark the CVE as exploited in the wild.
Quick check
Who can trigger it?
A user permitted to add or edit a Document Library block, per the record.
Why does it keep running?
The record says the stored value runs each time the published page renders.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
