PT-2026-1832 · October · October

Published 2026-01-09 · Updated 2026-01-10 · CVE-2025-61674

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions October versions prior to 3.7.13 October versions prior to 4.0.12

Description October is a Content Management System (CMS) and web platform. A cross-site scripting (XSS) issue exists in October CMS backend configuration forms. A user possessing the Global Editor Settings permission can inject malicious HTML/JS into the stylesheet input at Markup Styles. A crafted input can bypass the intended context, enabling arbitrary script execution across backend pages for all users. The vulnerability affects the backend configuration forms and specifically involves the stylesheet input at Markup Styles.

Recommendations Update to October version 3.7.13 or later. Update to October version 4.0.12 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-61674

GHSA-GXXC-M74C-F48X

Affected Products

October

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61674.json · Exploit
• https://github.com/octobercms/october/security/advisories/GHSA-gxxc-m74c-f48x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-61674 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gxxc-m74c-f48x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61674 · Security Note
• https://github.com/octobercms/october · Note
• https://t.me/CVEtracker/41908 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2009899997739835642 · Twitter Post