CVE-2026-85386 Concrete CMS before 9.5.4 stored is vulneratble to cross-site scripting via unauthenticated XML/XSLT file upload in the Form Block

Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. Plain XML uploads were validated by file extension only and stored as publicly accessible files that were served inline from the application's own origin. An unauthenticate...

CVE-2026-85386

Concrete CMS before 9.5.4 is vulnerable to stored cross-site scripting via unauthenticated file upload in the Form Block component. XML and XSLT documents submitted through a public file-upload question were validated by file extension only and served inline from the application's own origin. An ...