# CVE-2026-25133: October CMS stored XSS in SVG sanitization logic

Source: https://junglewise.ai/threats/cve-2026-25133-october-cms-stored-xss-in-svg-sanitization-logic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-14. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-25133 · Severity: medium · CVSS 4.8 · Published 2026-04-14

October CMS, a popular web platform for managing website content, contains a security flaw in how it handles uploaded image files. An authorized user with permission to upload media could bypass security filters to upload a malicious SVG file containing hidden scripts. If an administrator views this file, the script could execute, potentially allowing the attacker to gain higher-level administrative control over the website.

Technologies: [October CMS](https://junglewise.ai/threats/technologies/october-cms), [october/rain (Packagist)](https://junglewise.ai/threats/technologies/october-rain). Vendors: [October CMS](https://junglewise.ai/threats/vendors/october-cms), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-25133 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25133 being exploited in the wild.

**How severe is CVE-2026-25133?** Medium severity, with a CVSS score of 4.8, published 14 April 2026.

**Which products and versions are affected?** October CMS < 3.7.14, >= 4.0.0, < 4.1.10, <= 3.7.13, >= 4.0.0, <= 4.1.9; october/rain (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=4.1.10.

**Is there a fix for CVE-2026-25133?** Yes. october/rain (Packagist): upgrade to 4.1.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25133 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-25133?** Check whether you run October CMS or october/rain (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- october/rain (Packagist): upgrade to 4.1.10 or later

  ```sh
  composer require october/rain:^4.1.10
  ```


## Technical details

A stored cross-site scripting (XSS) vulnerability exists in October CMS due to a flaw in the regex pattern used for SVG sanitization. The pattern intended to strip 'on*' event handler attributes (like onclick or onload) can be bypassed by exploiting how the regex matches attribute boundaries. An attacker with backend access and 'media.library.create' permissions can upload a crafted SVG file. When a superuser views or embeds this SVG, the embedded JavaScript executes in their context, potentially leading to privilege escalation. The issue is fixed in versions 3.7.14 and 4.1.10.

## Affected products

- October CMS October CMS < 3.7.14, >= 4.0.0, < 4.1.10

## Identifiers

- CVE-2026-25133
- GHSA-gcqv-f29m-67gr

## Timeline

- 2026-04-14: advisory
- 2026-04-14: patched

## References

- [https://github.com/octobercms/october/security/advisories/GHSA-gcqv-f29m-67gr](https://github.com/octobercms/october/security/advisories/GHSA-gcqv-f29m-67gr)

## Related threats

- [October CMS information disclosure in INI settings parser](https://junglewise.ai/threats/cve-2026-25125-october-cms-information-disclosure-in-ini-settings-parser)
- [October CMS October Rain Twig sandbox bypass via collection methods](https://junglewise.ai/threats/cve-2026-22692-october-cms-october-rain-twig-sandbox-bypass-via-collection)
- [OctoberCMS Cross-Site Scripting](https://junglewise.ai/threats/cve-2017-15284-octobercms-cross-site-scripting)
- [Account Takeover in Octobercms](https://junglewise.ai/threats/cve-2021-32648-october-cms-improper-authentication)
- [October CMS Session ID not invalidated after logout](https://junglewise.ai/threats/cve-2021-3311-october-cms-session-id-not-invalidated-after-logout)