Executive brief
Concrete CMS, a content management platform, failed to properly validate XML and XSLT files uploaded through public form components. An attacker could upload a malicious XML file containing references to external stylesheets, which would execute JavaScript when an authenticated administrator viewed the file in a browser. If the victim was an admin, the attacker's script could perform administrative actions such as creating unauthorized user accounts.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Form Block file-upload feature. XML documents were validated only by file extension and stored as publicly accessible files served inline from the application origin. An attacker could craft an XML document with an xml-stylesheet processing instruction pointing to an attacker-controlled XSLT stylesheet on the same origin. When a victim (especially an authenticated administrator) opened the file directly in a browser, the browser fetched and processed the stylesheet, executing embedded JavaScript in the Concrete CMS origin with the victim's privileges. The vulnerability required an unauthenticated attacker to upload the malicious file and a victim to interact with it. The issue was resolved in version 9.5.4.
Affected products
- Concrete CMS Concrete CMS before 9.5.4
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fixed in version 9.5.4