CVE-2026-85385 is a stored cross site scripting flaw in Concrete CMS below 9.5.4 (CVSS 9.6, critical). The user timezone field was not validated and was shown unencoded to administrators. The fix is Concrete CMS 9.5.4. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The record lists Concrete CMS below 9.5.4. The weakness is CWE-79, cross site scripting. The uTimezone value was not validated on write and was rendered without output encoding on the Dashboard user management page.
There are conditions. Exploitation requires the concrete.misc.user_timezones option, which is off by default. Before 9.5.3 the field was reachable by any authenticated user through the profile editor. In 9.5.3 it also became reachable by visitors through public registration, which must then be enabled. The Concrete team scored it 7.7 under CVSS 4.0. The record is not in the CISA KEV catalog.
How to check if you're exposed
Check the version in the Dashboard under system information, or in the version file of your install. Then check your configuration for the user timezones option.
grep -rn "user_timezones" application/config/ 2>/dev/null
If the option is off, the record says the flaw is not reachable, but you should still update.
What to do now
- Upgrade Concrete CMS to 9.5.4 or later.
- Check whether concrete.misc.user_timezones is enabled and turn it off if you do not use it.
- If public registration is on and you do not need it, turn it off.
- Review user records for unusual timezone values.
- Ask administrators to avoid viewing user records until the update is applied.
Why it matters
Stored XSS means a value saved by one person runs as script in another person's browser. Here the target is an administrator, so the script runs with admin rights and can change settings or create accounts, as the record describes.
Two fixes are standard: validate input on write, since a timezone should be one of a known list, and encode output on every page that shows it.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I safe if the timezone option is off?
The record says exploitation requires that option, and it is off by default. Update anyway, since settings change over time.
Sources
Last reviewed: 19 October 2026.
