CVE-2026-85386: Concrete CMS XML/XSLT Upload XSS Vulnerability

CVE-2026-85386 Overview

CVE-2026-85386 is a stored cross-site scripting (XSS) vulnerability in Concrete CMS versions prior to 9.5.4. The flaw resides in the public Form Block file-upload question, which fails to sanitize XML and Extensible Stylesheet Language Transformations (XSLT) documents. Uploaded files pass only an extension check and are served inline from the application origin. An unauthenticated attacker can upload an XML file that references a same-origin XSLT stylesheet through an xml-stylesheet processing instruction. When an administrator opens the file, the browser executes attacker-controlled JavaScript under the Concrete CMS origin.

Critical Impact
An unauthenticated attacker can achieve stored XSS that, when triggered by an administrator, allows account takeover and creation of new users in the Administrators group.

Affected Products

Concrete CMS versions prior to 9.5.4
Concrete CMS Form Block with file-upload question enabled
Public-facing Concrete CMS instances that accept anonymous form submissions

Discovery Timeline

Vulnerability reported by Valentin SARRE (Independent security researcher)
2026-09-16 - CVE-2026-85386 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-85386

Vulnerability Analysis

The vulnerability [CWE-79] arises from insufficient validation of user-supplied files in the Concrete CMS Form Block. The file-upload question accepts XML documents based solely on the file extension and stores them at a publicly reachable path. Because the web server returns these files inline with an XML content type from the application's own origin, browsers treat them as active documents rather than downloads.

An attacker uploads two same-origin files: a malicious XSLT stylesheet and an XML document containing an xml-stylesheet processing instruction referencing that stylesheet. When a victim visits the XML URL, the browser fetches the referenced XSLT, transforms the XML into HTML, and executes any JavaScript embedded in the transformation output. Because execution occurs in the Concrete CMS origin, the script inherits the victim's session cookies.

If the victim is an authenticated administrator, the injected script can invoke administrative endpoints. The reporter demonstrated creation of a new user in the Administrators group, effectively achieving full application takeover from an unauthenticated starting position.

Root Cause

The root cause is validation by file extension only, combined with inline same-origin serving of uploaded content. XML and XSLT are not treated as active content types requiring sanitization, and no Content-Disposition or sandboxed origin is applied to public uploads.

Attack Vector

The attack requires network access to a public form containing a file-upload question and a target user who opens the stored file. Exploitation is a two-stage process: unauthenticated upload of the payload files, followed by a social-engineering step that lures an administrator to the stored XML URL.

The vulnerability is described in prose only; refer to the ConcreteCMS 9.5.4 Release Notes for vendor technical details.

Detection Methods for CVE-2026-85386

Indicators of Compromise

Uploaded files with .xml or .xsl/.xslt extensions in Concrete CMS public file storage directories
XML files containing <?xml-stylesheet processing instructions referencing same-origin URLs
Unexpected creation of user accounts assigned to the Administrators group
Web server access logs showing GET requests to uploaded XML files followed by administrative API calls from the same session

Detection Strategies

Scan the Concrete CMS file storage for XML and XSLT documents containing xml-stylesheet processing instructions or <script> elements inside XSLT output templates
Review administrator audit logs for user creation events that lack a corresponding legitimate administrative session
Correlate anonymous form submissions containing file uploads with subsequent administrator browser activity

Monitoring Recommendations

Alert on any new user added to the Administrators group
Monitor Concrete CMS access logs for direct requests to files under public upload paths with XML content types
Track outbound requests from administrator sessions immediately following the loading of an uploaded XML file

How to Mitigate CVE-2026-85386

Immediate Actions Required

Upgrade Concrete CMS to version 9.5.4 or later
Audit the public file storage for XML and XSLT files uploaded through Form Blocks and remove untrusted content
Review the Administrators group membership and remove any accounts that cannot be attributed to a legitimate change
Rotate credentials and session tokens for administrator accounts that may have opened untrusted uploads

Patch Information

Concrete CMS 9.5.4 addresses the issue by validating XML and XSLT content beyond the file extension. Refer to the ConcreteCMS 9.5.4 Release Notes for the full change list and upgrade guidance.

Workarounds

Disable file-upload questions in public Form Blocks until the patch is applied
Restrict allowed upload extensions on the web server to exclude .xml, .xsl, and .xslt
Serve uploaded files with a Content-Disposition: attachment header to prevent inline browser rendering
Host user-uploaded content on a separate, sandboxed origin so scripts cannot access the Concrete CMS session

bash

# Example nginx configuration to force download and block XML/XSLT uploads
location /application/files/ {
    add_header Content-Disposition "attachment" always;
    location ~* \.(xml|xsl|xslt)$ {
        return 403;
    }
}