Executive brief
Concrete CMS, a website content management system, failed to validate and safely display user-supplied timezone values in the Dashboard. An attacker could inject malicious scripts into the timezone field, which would execute in administrators' browsers when they viewed user accounts, potentially allowing the attacker to steal administrator credentials, create rogue admin accounts, or alter site settings without authorization.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the user timezone (uTimezone) field. The vulnerability exists because Concrete CMS did not validate the timezone value on input and did not output-encode it when rendering on the Dashboard user management page. The Date::getTimezoneDisplayName() function returns non-IANA timezone values unchanged, allowing arbitrary HTML/JavaScript to be stored and executed. In version 9.5.3 and below, authenticated users could exploit this via the account profile editor; in 9.5.3, the field became reachable to unauthenticated visitors through public registration. Exploitation requires the concrete.misc.user_timezones configuration to be enabled (off by default) and, for the unauthenticated attack path, requires public registration to be enabled. When an administrator views the affected user in the Dashboard, the stored payload executes in their session context, enabling admin-level compromise.
Affected products
- Concrete CMS Concrete CMS below 9.5.4
Timeline
- 2026-09-16: disclosed