CVE-2026-85386

Executive Summary

CVE-2026-85386 is a stored cross-site scripting (XSS) vulnerability in Concrete CMS versions prior to 9.5.4, caused by insufficient sanitization of XML and XSLT documents uploaded through a public Form Block file-upload question. An unauthenticated attacker can store a malicious XML document that references an attacker-supplied, same-origin XSLT stylesheet; when a victim—including an authenticated administrator—opens the file, the browser transforms the document and executes attacker-controlled JavaScript in the Concrete CMS origin. Successful exploitation in an administrator's browser enables privileged actions such as creating a new user in the Administrators group.

Technical Analysis

The vulnerability resides in the file-upload handling of the Form Block feature, specifically the public file-upload question type. Two distinct flaws combine to enable exploitation:

1. Extension-only validation of XML uploads. Plain XML documents uploaded through the public Form Block file-upload question were validated solely by file extension, with no content-level sanitization. This allowed an attacker to store an arbitrary XML document containing an xml-stylesheet processing instruction that points to an attacker-controlled XSLT stylesheet.

2. Inline serving from the application's own origin. The uploaded XML was stored as a publicly accessible file and served inline from the Concrete CMS origin rather than as a download or from a sandboxed/neutral origin. Because the file is rendered from the trusted application origin, any script executed during its rendering inherits that origin's privileges.

The attack mechanism is an XSLT-based reflected/stored cross-site scripting via ASX (XML stylesheet) processing:

• The browser retrieves the stored XML file.
• The xml-stylesheet processing instruction causes the browser to fetch the referenced XSLT stylesheet.
• The browser applies the XSLT transformation, producing HTML derived from the stylesheet.
• JavaScript embedded in the transform output executes in the Concrete CMS origin.

This is a classic case of CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), amplified here by an XSLT transformation step that occurs client-side in the browser rather than server-side. Because the stylesheet is fetched same-origin from an attacker-supplied reference, the resulting DOM inherits the Concrete CMS origin's trust context.

Key technical characteristics:

• No authentication required to plant the payload. The Form Block file-upload question is publicly exposed by design (it is part of the form submission flow), so an unauthenticated visitor can trigger storage of the malicious XML.
• Victim interaction is required (UI:A per the CVSS vector). The victim must open the stored file directly in a browser.
• Attack requires adjacent conditions (AT:P) and low privileges (PR:L) with high confidentiality, integrity, and availability impacts (VC:H/VI:H/VA:H) on the vulnerable system, but no subsequent system impact (SC:N/SI:N/SA:N).
• Administrator context yields high-impact outcomes. If the victim is a logged-in administrator, the injected script executes with that session and can perform privileged operations, including administrative user creation.

The description does not disclose the specific internal function, class, or endpoint names in Concrete CMS that handle the upload validation or storage. No public PoC, Nuclei template, or exploit code has been observed at the time of writing.

Exploitation Scenarios

The following attack chain is strictly derived from the NVD description. No specific function names, class names, or endpoint paths are provided in the source data, so the chain is described at the vulnerability-class level.

Step 1 — Reconnaissance / target identification. An attacker identifies a Concrete CMS instance running a version prior to 9.5.4 that exposes a Form Block containing a public file-upload question. Such forms are typically reachable by unauthenticated visitors by design. Attackers can fingerprint Concrete CMS deployments using standard web-fingerprinting techniques (favicon hash, distinctive HTML markers such as concrete5 or ccm- class names) and Shodan/FOFA-style queries for the product string.

Step 2 — Triggering the flaw class. The attacker prepares an XML document containing an xml-stylesheet processing instruction whose href points to an attacker-controlled XSLT stylesheet. Because the upload validation checks only the file extension, the XML content is accepted and stored. The file is then hosted publicly and served inline from the Concrete CMS origin.

Step 3 — Payload / execution method. The attacker delivers the URL of the stored XML file to a victim (for example, via email, chat, or a forum post) and induces the victim to open it directly in a browser. The browser:

• retrieves the XML file,
• follows the xml-stylesheet instruction,
• fetches the referenced XSLT stylesheet,
• applies the XSLT transformation,
• renders resulting HTML and executes attacker-controlled JavaScript in the Concrete CMS origin.

Because the code executes in the Concrete CMS origin, it has access to the victim's session cookies (subject to HttpOnly constraints on the session cookie) and can issue authenticated same-origin requests. Note: this section refrains from inventing endpoint names, parameter names, or function names; the description does not disclose them.

Step 4 — Post-exploitation impact. If the victim is an authenticated administrator, the script can act with that administrator's session. The reporter demonstrated creation of a new user in the Administrators group — a full administrative-privilege escalation achieved through the victim's browser. This grants the attacker a persistent administrative foothold on the Concrete CMS instance.

No public PoC or exploit code is available; the attack chain above is inferred from the vulnerability class (stored XSS via XSLT transformation) and the behavior explicitly described in the NVD entry.

Impact Assessment

• Confidentiality (VC:H): Script executing in the Concrete CMS origin can read any data accessible to the victim's session, including potentially sensitive administrative pages.
• Integrity (VI:H): The attacker can perform authenticated state-changing actions. The demonstrated impact — creating an Administrators-group user — represents a total compromise of the application's authorization model.
• Availability (VA:H): With administrative privileges, an attacker can modify or destroy content, disable features, or otherwise disrupt the application.
• Scope (SC:N / SI:N / SA:N): The impact is confined to the vulnerable Concrete CMS system; no subsequent-system impacts are described in the supplied data.

Business impact:

• Administrative account creation enables persistent backdoor access that survives page refreshes and may be difficult to detect without auditing user-creation events.
• Concrete CMS deployments are frequently used as public-facing corporate websites, intranets, and marketing portals. A compromised origin can be used to inject malicious content, steal visitor data, or pivot to connected systems via administrator access.
• The stored-XSS vector means multiple victims can be targeted from a single stored payload; because the payload is stored on a trusted origin, standard phishing education is less effective once a victim is induced to click the hosted file.

Affected systems: Any Concrete CMS installation prior to 9.5.4 that exposes a Form Block with a public file-upload question. Actual exposure depends on whether such forms are configured and reachable.

Detection Guidance

Detection should focus on (a) the presence of stored XML files in public upload directories, (b) requests fetching XSLT stylesheets referenced from such XML files, and (c) anomalous administrator sessions performing user-creation actions.

Sigma Rule

title: Concrete CMS CVE-2026-85386 XSLT-Based Stored XSS Abuse
id: 8b2f4c1e-7a3d-4f9b-9c1e-4d5a6b7c8e9f
status: experimental
description: Detects suspicious access to uploaded XML files and XSLT stylesheets consistent with CVE-2026-85386 exploitation in Concrete CMS.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85386
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - attack.t1059.007
logsource:
  category: webserver
  product: generic
detection:
  selection_xml_upload:
    cs-method: 'GET'
    cs-uri-stem|endswith: '.xml'
  selection_xslt_fetch:
    cs-uri-stem|endswith:
      - '.xsl'
      - '.xslt'
  selection_user_created:
    cs-uri-query|contains: 'create_user'
  condition: (selection_xml_upload or selection_xslt_fetch or selection_user_created)
falsepositives:
  - Legitimate XML sitemap or feed access
  - Legitimate XSLT assets used by the site
level: medium

YARA Rule

rule CVE_2026_85386_ConcreteCMS_XSLT_XSS
{
    meta:
        description = "Detects XML files using xml-stylesheet processing instructions that may be leveraged for XSLT-based stored XSS in Concrete CMS (CVE-2026-85386)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85386"
        severity = "high"

    strings:
        $pi1 = "<?xml-stylesheet" ascii nocase
        $pi2 = "<?xml-stylesheet" wide nocase
        $t1 = "type=\"text/xsl\"" ascii nocase
        $t2 = "type='text/xsl'" ascii nocase
        $t3 = "type=\"text/xml\"" ascii nocase
        $xsl1 = "<xsl:stylesheet" ascii nocase
        $xsl2 = "<xsl:template" ascii nocase
        $js1  = "javascript:" ascii nocase
        $js2  = "onload=" ascii nocase
        $js3  = "onerror=" ascii nocase
        $script = "<script" ascii nocase

    condition:
        filesize < 512KB and
        ($pi1 or $pi2) and
        ($t1 or $t2 or $t3) and
        (any of ($xsl*) or any of ($js*) or $script)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85386 Concrete CMS XSLT Stored XSS - XSLT Stylesheet Fetch from Uploaded XML"; flow:established,to_client; http.response_body; content:"<html"; nocase; http.response_body; content:"<script"; nocase; classtype:web-application-attack; reference:cve,2026-85386; reference:url,valtersit.com; sid:9000001; rev:1;)

alert http any any -> any any (msg:"CVE-2026-85386 Concrete CMS Suspicious XML Upload with xml-stylesheet Instruction"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"<?xml-stylesheet"; nocase; classtype:web-application-attack; reference:cve,2026-85386; sid:9000002; rev:1;)

alert http any any -> any any (msg:"CVE-2026-85386 Concrete CMS Possible Admin Creation via Stored XSS Session"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"create_user"; classtype:attempted-admin; reference:cve,2026-85386; sid:9000003; rev:1;)

Elastic Detection

sequence by process.entity_id
  [ network where event.action == "network_flow" and
      url.path : "*.xml" and url.extension == "xml" ]
  [ network where event.action == "network_flow" and
      url.path : "*.xsl*" ]

any where
  url.path : ("*.xml", "*.xsl", "*.xslt") and
  network.protocol == "http" and
  process.name : ("apache2", "httpd", "nginx", "php-fpm")

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri=lower(uri)
| where match(uri, "\.xml$") OR match(uri, "\.xsl$") OR match(uri, "\.xslt$")
| stats count values(uri) as uris by clientip, host, status
| where count > 0
| sort - count

index=web sourcetype=access_combined
| search uri="*create_user*" OR uri="*user*/add*"
| stats count values(uri) as uris values(clientip) as src by user, host, status
| where status >= 200 AND status < 400

Wazuh OSSEC Rule

<group name="web,concrete_cms,cve-2026-85386,">
  <rule id="100601" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">\.xml$</field>
    <description>CVE-2026-85386: Access to uploaded XML file potentially used for XSLT-based XSS in Concrete CMS</description>
    <group>web_attack,</group>
  </rule>

  <rule id="100602" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">\.xsl$|\.xslt$</field>
    <description>CVE-2026-85386: XSLT stylesheet fetch - possible Concrete CMS stored XSS exploitation</description>
    <group>web_attack,</group>
  </rule>

  <rule id="100603" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">create_user</field>
    <description>CVE-2026-85386: Possible administrative user creation via XSS session hijack in Concrete CMS</description>
    <group>web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in Concrete CMS 9.5.4 ("before 9.5.4"), but no vendor advisory, commit hash, or patch reference is present in the supplied data. Until a verified vendor patch is confirmed and applied, treat affected instances as unpatched.

1) Immediate mitigations

• Disable or restrict public file-upload questions in Form Blocks where business requirements permit. Removing public upload capability eliminates the storage step of the attack chain.
• Restrict accepted file types for upload questions to a minimal allowlist (e.g., images only), and reject XML, XSL, XSLT, and any SVG documents that may embed processing instructions.
• Serve uploaded files with Content-Disposition: attachment and Content-Type: application/octet-stream (or a strictly limited MIME whitelist) to prevent inline rendering in the origin.
• Host user uploads on a separate, cookieless origin (e.g., a CDN or sandbox subdomain) so any script executed in a transformed document does not inherit the main application's session cookies.
• Enforce a strict Content-Security-Policy on the application origin that disallows unsafe-inline and restricts script-src to trusted sources. This can prevent execution of XSLT-transformed scripts, though CSP alone is not a full substitute for fixing the upload validation.

2) Patch / upgrade steps

• Plan an upgrade to Concrete CMS 9.5.4 or later once a vendor advisory and release artifacts are available. Verify the integrity of the release (signature/hash) before deployment.
• Monitor the Concrete CMS security release channel and NVD entry for CVE-2026-85386 for the official advisory and confirmation of the exact fixed version.
• After upgrading, re-test the Form Block file-upload question to confirm XML content is rejected or sanitized, and that uploaded files are no longer served inline from the application origin.

3) Long-term hardening

• Adopt content-based validation (magic bytes / structural parsing) rather than extension-only checks for all uploads.
• Add automated SAST/DAST scanning focused on upload handling and XSS sinks into CI/CD.
• Deploy server-side sanitization for any XML processing (disable external entity resolution and stylesheet processing where not required).
• Implement auditable logging and alerting for administrative user creation and privilege changes (see Detection Guidance) to catch exploitation attempts early.
• Conduct periodic red-team validation of public form and upload surfaces.

References

1. NVD — CVE-2026-85386: https://nvd.nist.gov/vuln/detail/CVE-2026-85386
2. Concrete CMS official project site / security releases: https://www.concretecms.org/ (verify availability of a 9.5.4 advisory)
3. CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
4. FIRST — CVSS v4.0 Specification (see vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N): https://www.first.org/cvss/v4.0/specification
5. CISA Known Exploited Vulnerabilities Catalog (checked — CVE-2026-85386 is not listed as of this writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild status: No public PoC, exploit code, or Nuclei template is available for CVE-2026-85386 in the supplied data, and the CVE is not in CISA KEV. No specific threat-actor campaigns have been attributed. Credit for discovery: Valentin SARRE (independent security researcher), per the NVD description.