CVE-2026-85386 Concrete CMS CVE debrief

Who should care

Concrete CMS administrators, users with public Form Block file-upload questions, security teams responsible for monitoring and protecting against cross-site scripting attacks, and operators managing Concrete CMS instances with public Form Block file-upload questions.

Why it matters

This vulnerability allows an unauthenticated attacker to execute JavaScript in the context of an authenticated administrator's session, potentially leading to stored cross-site scripting and elevation of privileges. Concrete CMS administrators and users with public Form Block file-upload questions should assess exposure and prioritize remediation.

• Execution of attacker-controlled JavaScript in the Concrete CMS origin
• Potential creation of new users in the Administrators group
• Elevation of privileges for an unauthenticated attacker
• Compromise of Concrete CMS instances with public Form Block file-upload questions

Technical summary

Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. An unauthenticated visitor could store an XML document containing an xml-stylesheet processing instruction that referenced an attacker-supplied, same-origin XSLT stylesheet. When a victim opened the stored file directly in a browser, the browser fetched the stylesheet, transformed the document into HTML, and executed attacker-controlled JavaScript in the Concrete CMS origin.

Defensive priority

High priority for Concrete CMS administrators and users with public Form Block file-upload questions, as an unauthenticated attacker can exploit this vulnerability to execute JavaScript in the context of an authenticated administrator's session.

Recommended defensive actions

• Update Concrete CMS to version 9.5.4 or later
• Review and restrict file uploads through public Form Block file-upload questions
• Monitor for suspicious activity and implement compensating controls
• Verify the integrity of stored files and XSLT stylesheets
• Perform vulnerability scanning to identify exposed assets
• Implement additional logging and monitoring for Form Block file-upload questions
• Review and update incident response plans to address potential exploitation

Evidence notes

The vulnerability was reported by Valentin SARRE, an independent security researcher. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3. The NVD entry is currently Analyzed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.