CVE-2026-25133
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
October CMS versions prior to 3.7.14 and 4.1.10 contain a stored cross-site scripting vulnerability in the SVG sanitization logic. The regex pattern used to strip event handler attributes could be bypassed using a crafted payload, allowing malicious SVG files to be uploaded through the Media Manager with embedded JavaScript. Exploitation could lead to privilege escalation if a superuser views or embeds the malicious SVG, and requires authenticated backend access with media upload permissions.
Risk Assessment
Attackers can execute arbitrary scripts in the context of a superuser's browser, potentially leading to session theft, content modification, or further privilege escalation.
Recommendation
Update October CMS to version 3.7.14 or 4.1.10 and restrict media upload permissions.
Original NVD description (English source)
October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a stored cross-site scripting (XSS) vulnerability in the SVG sanitization logic. The regex pattern used to strip event handler attributes (such as onclick or onload) could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries, allowing malicious SVG files to be uploaded through the Media Manager with embedded JavaScript. Exploitation could lead to privilege escalation if a superuser views or embeds the malicious SVG, and requires authenticated backend access with media upload permissions. The SVG must be viewed or embedded in a page for the payload to trigger. This issue has been fixed in versions 3.7.14 and 4.1.10.