SB2026101953 - Multiple vulnerabilities in October CMS

Description

This security bulletin contains information about 3 vulnerabilities.

1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote privileged user to execute arbitrary JavaScript in the application origin when a victim opens a malicious SVG asset URL.

The vulnerability exists due to improper sanitization in the October CMS Editor module's editorRenameFileOrDirectory handler when renaming a non-SVG file to an SVG file. A remote privileged user can use the editor.cms_assets permission to upload malicious SVG content under an allowed non-SVG extension, rename the file to .svg without invoking Html::cleanVector, and induce a victim to open the public theme asset URL to execute arbitrary JavaScript in the application origin.

2) Arbitrary file upload (CVE-ID: CVE-2026-63193)

CWE-ID: CWE-434 - Unrestricted Upload of File with Dangerous Type

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to write files with arbitrary extensions and contents into the public media folder, enabling stored cross-site scripting and, on servers configured to execute PHP in that folder, arbitrary code execution.

The vulnerability exists due to missing destination extension validation in the October CMS Media Library image crop handler when processing a user-supplied output filename. A remote privileged user can use the media.library.create permission to upload malicious content disguised as a .jpg file and invoke a zero-dimension crop, which copies the original bytes without re-encoding, to create an .html or .svg file that executes script when opened from the application origin, or a .php file that executes code if the server permits PHP execution in the media folder.

3) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote privileged user to execute arbitrary JavaScript in another backend user's browser within the October CMS backend origin.

The vulnerability exists due to improper HTML sanitization in the BackendFormWidgetsMarkdownEditor form widget when rendering stored markdown previews: the Vue-based path misconfigures the sanitizer, while the legacy jQuery-based path injects unsanitized HTML. A remote privileged user can store raw HTML such as <img src=x onerror=...> in a markdown field to execute arbitrary JavaScript when another backend user opens the same record and its preview renders.

Remediation

Install update from vendor's website.

References

• https://github.com/octobercms/october/security/advisories/GHSA-g59g-hg2r-22vp
• https://github.com/octobercms/october/security/advisories/GHSA-mqwx-84vv-mp26
• https://github.com/octobercms/october/security/advisories/GHSA-7qg6-3972-x29w