Executive brief
October CMS, a popular web platform for managing website content, contains a security flaw in how it handles uploaded image files. An authorized user with permission to upload media could bypass security filters to upload a malicious SVG file containing hidden scripts. If an administrator views this file, the script could execute, potentially allowing the attacker to gain higher-level administrative control over the website.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in October CMS due to a flaw in the regex pattern used for SVG sanitization. The pattern intended to strip 'on*' event handler attributes (like onclick or onload) can be bypassed by exploiting how the regex matches attribute boundaries. An attacker with backend access and 'media.library.create' permissions can upload a crafted SVG file. When a superuser views or embeds this SVG, the embedded JavaScript executes in their context, potentially leading to privilege escalation. The issue is fixed in versions 3.7.14 and 4.1.10.
Affected products
- October CMS October CMS < 3.7.14, >= 4.0.0, < 4.1.10
Timeline
- 2026-04-14: advisory
- 2026-04-14: patched