CVE-2026-85385

Concrete CMS versions below 9.5.4 fail to validate the user timezone value (uTimezone) on write and render it without output encoding on the Dashboard user management page, since Date::getTimezoneDisplayName() passes through any non-IANA value unchanged, enabling stored cross-site scripting. An attacker stores a script payload in the timezone field, and it executes in an administrator's browser when the admin views that user in the Dashboard, running in the admin session. With admin-level script execution, the attacker can read CSRF tokens, create administrator accounts, or change site settings. All versions below 9.5.4 are affected if the concrete.misc.user_timezones setting is enabled (off by default); in 9.5.3 the field is reachable by unauthenticated visitors when public registration is enabled, while in versions below 9.5.3 it is reachable by any authenticated user through the account profile editor. No public proof-of-concept or in-the-wild exploitation is currently known, and the issue is not listed in CISA's KEV.

What to do: Upgrade to Concrete CMS 9.5.4 or later. As interim mitigation, disable concrete.misc.user_timezones (and public registration if you rely on the 9.5.3 path), and audit existing user records for suspicious timezone values plus the Dashboard for unexpectedly created administrator accounts or changed site settings.