CVE-2026-85385: Concrete CMS Stored XSS Vulnerability

CVE-2026-85385 Overview

CVE-2026-85385 is a stored cross-site scripting (XSS) vulnerability in Concrete CMS versions below 9.5.4. The flaw resides in the user timezone field (uTimezone), which the application failed to validate on write and rendered without output encoding on the Dashboard user management page. When an administrator viewed an affected user profile, the injected payload executed in the admin's browser session. Attackers could leverage this access to read Cross-Site Request Forgery (CSRF) tokens, create administrator accounts, or modify site settings. The vulnerability is tracked under CWE-79 and was reported by Suraj Bhosale.

Critical Impact
Successful exploitation grants full administrative control over the Concrete CMS instance by hijacking an administrator's authenticated session.

Affected Products

Concrete CMS versions below 9.5.4
Concrete CMS 9.5.3 (unauthenticated path via public registration)
Concrete CMS versions below 9.5.3 (authenticated path via account profile editor)

Discovery Timeline

2026-09-16 - CVE-2026-85385 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-85385

Vulnerability Analysis

The vulnerability stems from missing input validation on the uTimezone user field combined with unsafe output rendering in the Dashboard. Concrete CMS accepts any string submitted as the user's timezone without verifying it matches a valid IANA timezone identifier. When the Dashboard user management page later renders the stored value, Date::getTimezoneDisplayName() returns any non-IANA value unchanged. The Dashboard then writes that raw string into the HTML response without output encoding, allowing arbitrary script to execute in the administrator's browser.

Exploitation requires the concrete.misc.user_timezones configuration option to be enabled. This setting is off by default. The unauthenticated attack path additionally requires public user registration to be enabled on the site.

Root Cause

The root cause is a two-part failure. First, the write path does not enforce an allowlist of IANA timezone identifiers for the uTimezone attribute. Second, the read path treats the stored value as trusted display text and emits it into HTML without contextual escaping. Together these gaps produce a stored XSS sink in an administrator-only view.

Attack Vector

In Concrete CMS 9.5.3, an unauthenticated visitor can inject the payload through the public registration form. In versions below 9.5.3, any authenticated user can inject the payload through the account profile editor. The payload is dormant until an administrator opens the affected user's profile in the Dashboard user management page. Execution then occurs in the administrator's session context, enabling account creation, configuration changes, and CSRF token theft.

No verified public exploit code is available. See the Concrete CMS Version 9.5 Release Notes for vendor-published technical details.

Detection Methods for CVE-2026-85385

Indicators of Compromise

User records containing uTimezone values that do not match valid IANA timezone identifiers such as America/New_York or Europe/London.
Presence of HTML tags, angle brackets, or JavaScript event handler substrings (<script, onerror=, onload=) inside stored uTimezone fields.
Unexpected creation of new administrator accounts or changes to site settings shortly after Dashboard user management page views.

Detection Strategies

Query the users database table for uTimezone values that fail IANA timezone validation and flag anomalies for review.
Inspect web server access logs for POST requests to the registration endpoint or profile editor that include suspicious characters in the timezone parameter.
Correlate administrator session activity with subsequent privileged actions such as user creation or configuration changes.

Monitoring Recommendations

Enable audit logging for administrator account creation and configuration modifications within Concrete CMS.
Monitor the concrete.misc.user_timezones setting to confirm it remains disabled unless explicitly required.
Alert on Dashboard user management page views immediately followed by privileged API calls from the same session.

How to Mitigate CVE-2026-85385

Immediate Actions Required

Upgrade Concrete CMS to version 9.5.4 or later on all instances.
Disable the concrete.misc.user_timezones configuration option if it is currently enabled and not required.
Disable public user registration on sites running 9.5.3 until the patch is applied.
Audit existing user records for malicious uTimezone values and sanitize any entries containing script content.

Patch Information

Concrete CMS 9.5.4 resolves the vulnerability by validating the uTimezone value against IANA timezone identifiers on write and applying output encoding on the Dashboard user management page. Refer to the Concrete CMS Version 9.5 Release Notes for full patch details.

Workarounds

Set concrete.misc.user_timezones to false in the site configuration to remove the field from user-facing forms.
Restrict public registration to trusted contexts or require administrator approval for new accounts.
Deploy a Web Application Firewall (WAF) rule to block requests containing HTML or script markup in the timezone parameter.

bash

# Configuration example: disable user timezone selection in Concrete CMS
# Edit application/config/concrete.php or use the CLI configuration tool
php concrete/bin/concrete5 c5:config:set concrete.misc.user_timezones false