CVE-2026-85385

Executive Summary

CVE-2026-85385 is a stored cross-site scripting (XSS) vulnerability in Concrete CMS below version 9.5.4, in which the user timezone field (uTimezone) is neither validated on write nor output-encoded on render in the Dashboard user management page. Because Date::getTimezoneDisplayName() returns any non-IANA value unchanged, an attacker can persist an arbitrary script payload into the timezone field that executes in an administrator's browser when the affected user profile is viewed in the Dashboard. Successful exploitation runs script within the administrator's authenticated session, enabling CSRF token theft, creation of rogue administrator accounts, and modification of site settings — a full administrative compromise of the CMS instance under the stated preconditions.

Technical Analysis

The vulnerability is a textbook stored XSS (CWE-79) arising from a missing-validation-on-input / missing-encoding-on-output pair, both of which must be absent for the flaw to be exploitable. The Concrete CMS NVD description identifies two independent defects:

1. Insufficient validation on write. The uTimezone attribute of a user record was not validated against the IANA timezone database (or any allowlist) when persisted. Any value supplied by the client was accepted and stored verbatim.

2. Insufficient output encoding on render. On the Dashboard user management page, the stored value is passed through Date::getTimezoneDisplayName(). Per the description, this helper returns any non-IANA value unchanged — meaning that if the stored string is not a recognized IANA identifier, it is emitted into the HTML response without escaping. This is the rendering sink that converts a stored string into executable script.

The attack surface is the user timezone field itself. Reachability differs by version, which materially changes the threat profile:

• Concrete CMS < 9.5.3: The field was reachable by any authenticated user through the account profile editor. This is a low-privilege-to-admin privilege escalation path: a self-registered or low-privileged account writes the payload, and an administrator later views that user in the Dashboard, triggering execution in the admin context.
• Concrete CMS 9.5.3: The field became reachable by unauthenticated visitors through public registration, removing the authentication requirement to plant the payload. This widens the attacker pool to anyone who can reach the registration endpoint, though it still depends on an administrator subsequently viewing the affected user record.
• Specifically versions < 9.5.4 are affected, with the fix expected in 9.5.4.

Two configuration gates constrain exploitation and explain the CVSS AT:P (Attack Requirements: Present) and UI:P (User Interaction: Passive/Required) values:

• concrete.misc.user_timezones must be enabled — this setting is off by default. If timezone handling is disabled, the vulnerable field is not present in the workflow and the flaw is not reachable.
• For the unauthenticated path (9.5.3), public registration must also be enabled.

The CVSS v4.0 vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (7.7 High) reflects:

• AV:N / AC:L — network-reachable, low attack complexity once preconditions are met.
• AT:P — non-default configuration required (user_timezones enabled; public registration for the unauth path).
• PR:N / UI:P — no privileges required in the 9.5.3 unauth path, but an administrator must view the record (passive/required user interaction).
• VC:H / VI:H / VA:H — High confidentiality, integrity, and availability impact on the vulnerable system, consistent with full admin session takeover.
• SC:N / SI:N / SA:N — no impact on subsequent systems, appropriate for a session-scoped XSS in this context.

The root cause class is entirely preventable: canonicalize/validate the timezone against a known-good list on input, and HTML-encode all user-controlled data at every output sink regardless of source. The getTimezoneDisplayName() fallback behavior — returning unrecognized input unchanged — is the specific design decision that turns a bad data value into an XSS sink.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the exact details present in the NVD description. Only the identifiers explicitly named in the description (uTimezone, Date::getTimezoneDisplayName(), the Dashboard user management page, concrete.misc.user_timezones) are used.

1) Reconnaissance / target identification. The attacker identifies a Concrete CMS installation below 9.5.4 (fingerprinting via known CMS fingerprints/HTTP headers/concrete5 artifacts). The attacker determines which access path is available: for 9.5.3, whether public registration is open; for earlier versions, whether the attacker holds or can obtain any authenticated account. The attacker also infers whether the non-default concrete.misc.user_timezones setting is enabled, since exploitation depends on it.

2) Triggering the flaw class (stored XSS via unvalidated input). Using the available path (public registration on 9.5.3, or the account profile editor on < 9.5.3), the attacker submits a timezone value into the uTimezone field that is not a valid IANA identifier. Because the field is not validated on write, the payload is persisted to the user record. The attacker does not need to defeat an allowlist; the absence of validation is the vulnerability.

3) Payload / execution method (vulnerability-class level). The attacker stores an HTML/JavaScript payload in the timezone field. When an administrator opens the Dashboard user management page and views the affected user, the stored value is passed to Date::getTimezoneDisplayName(). Because that helper returns unrecognized (non-IANA) values unchanged, the payload is rendered into the admin's page without output encoding and the browser executes it in the context of the administrator's authenticated Dashboard session.

4) Post-exploitation impact. Script executing in the admin session can, per the description:

• Read CSRF tokens available to the admin session.
• Create new administrator accounts.
• Change site settings.

This constitutes full administrative takeover of the CMS instance, from which an attacker can persist, modify content, and further pivot within the web application.

Impact Assessment

Business impact. A successful exploit yields an administrator-level session foothold in the CMS. Because the payload executes in the trusted admin context, the attacker can mint rogue administrator accounts and alter site settings — actions that are difficult to distinguish from legitimate administrator activity and that can be used to maintain persistence or stage defacement, content manipulation, or further intrusion. For organizations running Concrete CMS as a public-facing web property, this is a high-integrity and high-availability risk to the site itself (VC:H/VI:H/VA:H).

Affected systems. All Concrete CMS deployments below 9.5.4 where concrete.misc.user_timezones is enabled. The unauthenticated attack path specifically applies to 9.5.3 installations that also have public registration enabled. Earlier deployments (< 9.5.3) require an authenticated account, lowering the attacker population but not the impact.

Blast radius. Scope is limited to the vulnerable system (SC:N/SI:N/SA:N) — the flaw does not inherently propagate to downstream systems. However, because the post-exploit capability includes creating administrator accounts and changing settings, an attacker with admin access may be able to expand impact manually depending on CMS configuration (e.g., custom code, integrations, or stored content).

Exploitability reality check. The non-default prerequisite (user_timezones off by default) and the required administrator interaction reduce opportunistic mass-exploitation potential. CVSS rates this 7.7 High. There is no CISA KEV entry, no public PoC, and no evidence of in-the-wild exploitation in the supplied data. EPSS has not scored this CVE.

Detection Guidance

Detection strategy must account for: (a) unusual values arriving in the timezone field on write, and (b) HTML/script content being rendered on the Dashboard user management page. Because the payload is stored and later rendered, network detection alone is insufficient — hunting must correlate the write event with the subsequent admin view.

Sigma Rule

title: Concrete CMS Stored XSS via Unvalidated User Timezone Field (uTimezone) - CVE-2026-85385
id: 7f3a2c1e-9b4d-4e88-a1c2-5d6f0e9b8a71
status: experimental
description: Detects requests writing HTML/script content into the Concrete CMS uTimezone field, consistent with stored XSS exploitation (CVE-2026-85385).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85385
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.79
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-method: 'POST'
    cs-uri-stem|contains:
      - '/register'
      - '/account'
      - '/profile'
      - '/dashboard'
  selection_payload:
    cs-uri-query|contains:
      - 'uTimezone='
    cs-uri-query|re: '(?i)uTimezone=[^&]*(%3C|<|script|onerror|onload|javascript:)'
  condition: selection_endpoint and selection_payload
falsepositives:
  - Legitimate timezone values containing encoded characters (rare)
level: high

YARA Rule

rule CVE_2026_85385_ConcreteCMS_Stored_XSS_Timezone
{
    meta:
        description = "Detects stored XSS payloads targeting the Concrete CMS uTimezone field (CVE-2026-85385)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85385"
        date = "2026-01-01"
        severity = "high"

    strings:
        $uTz = "uTimezone" ascii nocase
        $tzfn = "getTimezoneDisplayName" ascii nocase
        $s1 = "<script" ascii nocase
        $s2 = "onerror=" ascii nocase
        $s3 = "onload=" ascii nocase
        $s4 = "javascript:" ascii nocase
        $s5 = "</script>" ascii nocase

    condition:
        ($uTz or $tzfn) and any of ($s*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85385 Concrete CMS Stored XSS via uTimezone field"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"uTimezone"; nocase; http.request_body; pcre:"/(?i)uTimezone=[^&]*(%3C|<|script|onerror|onload|javascript:)/"; reference:cve,2026-85385; classtype:web-application-attack; sid:202685385; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1h
  [ network where http.request.method == "POST" and
      http.request.body.content : ("uTimezone" and ("<script" or "onerror=" or "onload=" or "javascript:")) ]
  [ network where http.request.method == "GET" and
      url.path : ("*/dashboard*" or "*/user*") and
      http.response.body.content : ("<script" or "onerror=" or "onload=") ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval payload = urldecode(uri_query)
| where like(method, "POST")
| where match(payload, "(?i)uTimezone=[^&]*(%3C|<|script|onerror|onload|javascript:)")
| stats count values(uri_path) as paths by src_ip, user
| sort - count

Wazuh OSSEC Rule

<group name="web,concretecms,cve-2026-85385,">
  <rule id="202685385" level="12">
    <if_sid>31100</if_sid>
    <id>^POST</id>
    <match>uTimezone</match>
    <regex>(?i)uTimezone=[^&]*(%3C|&lt;|script|onerror|onload|javascript:)</regex>
    <description>CVE-2026-85385: Possible Concrete CMS stored XSS attempt via unvalidated uTimezone field</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_85385,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence is available from any tracked source. No vendor fix, workaround, or affected-version range is present in the supplied data. The CNA title context indicates the fix target is Concrete CMS 9.5.4, but this is not confirmed by any authoritative patch artifact and must not be treated as verified.

1) Immediate mitigations (compensating controls):

• Disable the vulnerable feature. Confirm concrete.misc.user_timezones is disabled (its default). If it is enabled and not operationally required, turn it off — this removes reachability of the vulnerable field entirely.
• Disable public registration if enabled and not required. This closes the unauthenticated attack path on 9.5.3.
• Restrict Dashboard access to the minimum set of trusted administrators; reduce the population of users who can trigger the render sink.
• Input-side filtering at the edge. Deploy WAF/reverse-proxy rules (see Suricata/Sigma logic above) to reject HTML/script content in the uTimezone parameter on /register, /account, /profile, and Dashboard endpoints. This is a stopgap, not a root fix.
• Audit existing user records for stored values in the timezone field that are not valid IANA identifiers; sanitize or clear any suspicious values.

2) Patch/upgrade steps:

• Monitor the Concrete CMS security advisories and releases for the confirmed fix. When a fixed release (reported target 9.5.4) is available and validated, upgrade all instances below 9.5.4.
• Before upgrading, export/inventory customizations and take a tested backup.
• After upgrade, re-verify user_timezones behavior and re-scan existing user records to clear any pre-existing payloads that survived the upgrade.

3) Long-term hardening:

• Enforce server-side allowlist validation of timezone identifiers against the IANA database on write, and context-aware output encoding at every render sink. Treat Date::getTimezoneDisplayName()-style fallback (return input unchanged) as an anti-pattern for any value derived from user input.
• Adopt a CMS update policy with timely security-patch windows; track Concrete CMS advisories.
• Apply least privilege to Dashboard roles and minimize administrator surface.
• Implement Content Security Policy (CSP) to reduce XSS impact, and set session CSRF/authorization protections to limit the ability of injected script to mint admin accounts or alter settings.
• Retain the detection rules above in production monitoring.

References

1. NVD — CVE-2026-85385: https://nvd.nist.gov/vuln/detail/CVE-2026-85385
2. Concrete CMS security advisories / release notes (consult the vendor security page for the confirmed fix and version — the data provided does not include a vendor advisory URL): https://www.concretecms.org/
3. CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
4. CVSS v4.0 Specification (for interpreting the vector): https://www.first.org/cvss/v4-0/
5. Reporter attribution: Suraj Bhosale (credit per NVD description).

Threat actor / exploit-in-the-wild evidence: None. There is no CISA KEV entry, no public PoC, no exploit code, and no reported in-the-wild exploitation in the supplied intelligence. EPSS has not yet scored this CVE.