Stored Cross-Site Scripting in Concrete CMS by Concrete5

CVE-2026-85385

What is CVE-2026-85385?

Concrete CMS versions below 9.5.4 exhibit a vulnerability that fails to validate the user timezone value, allowing attackers to inject a stored cross-site scripting payload. This payload activates in an administrator's browser, potentially enabling the execution of malicious scripts that can manipulate user accounts and site settings. The impact is exacerbated in version 9.5.3 due to the field's accessibility to unauthenticated users through public registration. To exploit this vulnerability, specific conditions regarding user timezone settings must be enabled.

References