CVE-2026-85385 Concrete CMS CVE debrief

Who should care

Defenders responsible for Concrete CMS installations, administrators of Concrete CMS-based websites, and security teams monitoring for cross-site scripting vulnerabilities should be aware of this vulnerability and take necessary actions to mitigate it.

Why it matters

A stored cross-site scripting vulnerability in Concrete CMS versions below 9.5.4 allows an attacker to execute malicious script in an administrator's browser session, potentially leading to unauthorized actions. Defenders should prioritize verifying and updating Concrete CMS installations, reviewing user timezone settings, and monitoring for suspicious activity.

• An attacker can execute malicious script in an administrator's browser session, potentially leading to unauthorized actions such as reading CSRF tokens, creating administrator accounts, or changing site settings.
• The vulnerability allows for stored cross-site scripting, which can be exploited by an attacker to perform actions on behalf of the administrator.
• Verification of Concrete CMS installations and user timezone settings is necessary to prevent exploitation.
• Remediation priority is high due to the potential for unauthorized actions and the ease of exploitation.

Technical summary

The vulnerability exists in the user timezone field of Concrete CMS versions below 9.5.4. An attacker can save a malicious payload in this field, which is then executed in an administrator's browser when they view the affected user in the Dashboard. The vulnerability requires the concrete.misc.user_timezones feature to be enabled and, in Concrete CMS 9.5.3, public registration to be enabled. This allows for stored cross-site scripting, potentially leading to unauthorized actions such as reading CSRF tokens, creating administrator accounts, or changing site settings. Defenders should prioritize verifying and updating Concrete CMS installations to version 9.5.4 or later, reviewing user timezone settings, and and

Defensive priority

Defenders should prioritize verifying and updating Concrete CMS installations to version 9.5.4 or later, reviewing user timezone settings, and ensuring that the concrete.misc.user_timezones feature is not enabled unless necessary.

Recommended defensive actions

• Verify and update Concrete CMS installations to version 9.5.4 or later
• Review user timezone settings and ensure that the concrete.misc.user_timezones feature is not enabled unless necessary
• Monitor for suspicious activity on the Dashboard user management page
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its CVSS v4.0 score of 7.7 and vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.