CVE-2026-85385 in Concrete CMS
Summary
by MITRE • 09/16/2026
Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on write and rendered it without output encoding on the Dashboard user management page, where Date::getTimezoneDisplayName() returns any non-IANA value unchanged. A stored cross-site scripting payload saved in this field executed in an administrator's browser when they viewed the affected user in the Dashboard, running script in the admin session (for example to read CSRF tokens, create administrator accounts, or change site settings). In Concrete CMS 9.5.3 the field became reachable by unauthenticated visitors through public registration; in Concrete CMS below 9.5.3, the same field was reachable by any authenticated user through the account profile editor. Exploitation required concrete.misc.user_timezones to be enabled (off by default), and the unauthenticated path additionally required public registration to be enabled. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.7 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Suraj Bhosale for reporting.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in Concrete CMS versions prior to 9.5.4 represents a critical stored cross-site scripting flaw rooted in insufficient input validation and the absence of output encoding within the user management subsystem. The core technical deficiency lies in how the application handles the uTimezone parameter during write operations on the Dashboard user management page. Specifically, the Date::getTimezoneDisplayName() function fails to validate whether the provided timezone value conforms to standard IANA (Internet Assigned Numbers Authority) time zone database formats. Instead of rejecting non-compliant inputs or sanitizing them, the system accepts arbitrary strings and renders them directly into the HTML response without applying any form of output encoding. This behavior creates a persistent injection point where malicious scripts can be stored within user profile data and subsequently executed in the context of privileged administrative sessions.
The operational impact of this vulnerability is severe due to its potential for privilege escalation and session hijacking. When an administrator views a compromised user's details on the Dashboard, the browser executes the injected script as part of that admin session. This allows attackers to perform actions with full administrative privileges, including reading anti-CSRF tokens embedded in page responses, creating new administrator accounts to maintain persistent access, or altering critical site settings and configurations. The persistence of this threat is exacerbated by its availability through multiple attack vectors depending on the specific version of Concrete CMS involved. In versions prior to 9.5.3, any authenticated user could exploit this flaw via the account profile editor, allowing internal users with low-level privileges to compromise higher-privileged accounts.
In Concrete CMS version 9.5.3 and earlier than 9.5.4, the attack surface expanded significantly as the vulnerable field became accessible through public registration forms. This change enabled unauthenticated visitors to inject malicious payloads directly into user profiles during the sign-up process. For exploitation via this vector, two conditions must be met: the concrete.misc.user_timezones feature flag must be enabled, which is disabled by default in most installations, and public registration must also be active on the site. Despite these prerequisites limiting immediate widespread exploitability, the risk remains high because many sites enable user time zones for localization purposes, and public registration is a common configuration for community-driven platforms. The successful exploitation of this vulnerability effectively bypasses standard authentication controls by leveraging trusted administrative interfaces to execute arbitrary code in a privileged context.
From a classification perspective, this flaw aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). The specific nature of the vulnerability involves stored XSS where malicious content is saved on the target server and later retrieved by victims. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior corresponds to techniques involving Client-side Injection for Code Execution and potentially Account Manipulation if used to create backdoor accounts. The severity assessment provided by the Concrete CMS security team assigns a CVSS v4.0 score of 7.7, reflecting high confidentiality, integrity, and availability impacts with low attack complexity and no required user interaction beyond viewing the compromised profile once an admin is present in the system.
Mitigation strategies must prioritize immediate patching to version 9.5.4 or later where these validation checks have been strengthened. For organizations unable to upgrade immediately, disabling the concrete.misc.user_timezones configuration option effectively neutralizes this specific attack vector by preventing the rendering of the vulnerable field altogether. Additionally, enforcing strict input validation on all user-supplied timezone data and implementing robust output encoding mechanisms such as HTML entity encoding for any dynamic content rendered in administrative interfaces are essential defensive measures. Security teams should also audit existing user profiles for suspicious timezone entries that may indicate prior exploitation attempts and review administrator activity logs for unauthorized account creations or configuration changes indicative of successful compromise.