CVE-2026-85386

Concrete CMS before 9.5.4 failed to sanitize XML and XSLT files submitted through a public Form Block file-upload question, validating uploads by file extension only and storing them as publicly accessible files served inline from the site's own origin. An unauthenticated visitor could upload an XML document containing an xml-stylesheet processing instruction that referenced an attacker-supplied, same-origin XSLT stylesheet; when a victim opened the stored XML directly, the browser applied the stylesheet and executed attacker-controlled JavaScript in the Concrete CMS origin, resulting in stored cross-site scripting. If the victim was an authenticated administrator, the script could act with that administrator's session, and the reporter demonstrated creation of a new user in the Administrators group. Any Concrete CMS deployment running a version before 9.5.4 that exposes a public form with a file-upload question is affected. No public proof-of-concept or in-the-wild exploitation is currently known, and the issue is not listed in CISA KEV.

What to do: Upgrade to Concrete CMS 9.5.4 or later. As interim mitigation, remove or restrict file-upload questions in public Form Blocks so XML/XSLT files cannot be uploaded, or serve uploads with attachment disposition and nosniff headers. Review the file manager for unexpected .xml/.xslt uploads and audit the Administrators group for unauthorized users.