Concrete Cms · Concrete Cms · CVE-2026-85386
**Name of the Vulnerable Software and Affected Versions**
Concrete CMS versions prior to 9.5.4
**Description**
Insufficient sanitization of XML and XSLT documents uploaded via a public Form Block file-upload question allows an unauthenticated visitor to store a malicious XML document. Because plain XML uploads are validated only by file extension and served inline from the application origin, an attacker can include an `xml-stylesheet` processing instruction referencing a same-origin XSLT stylesheet. When a victim opens the file, the browser executes attacker-controlled JavaScript in the application origin, resulting in stored cross-site scripting (XSS). If the victim is an authenticated administrator, this can lead to unauthorized actions, such as the creation of new administrative users.
**Recommendations**
Update to version 9.5.4 or later.