Arbitrary file upload in October CMS - CVE-2026-63193
Published: October 19, 2026
Vulnerability details
The vulnerability allows a remote privileged user to write files with arbitrary extensions and contents into the public media folder, enabling stored cross-site scripting and, on servers configured to execute PHP in that folder, arbitrary code execution.
The vulnerability exists due to missing destination extension validation in the October CMS Media Library image crop handler when processing a user-supplied output filename. A remote privileged user can use the media.library.create permission to upload malicious content disguised as a .jpg file and invoke a zero-dimension crop, which copies the original bytes without re-encoding, to create an .html or .svg file that executes script when opened from the application origin, or a .php file that executes code if the server permits PHP execution in the media folder.