PT-2026-1833 · Octobercms · October

Published 2026-01-09 · Updated 2026-01-10 · CVE-2025-61676

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions October versions prior to 3.7.13 October versions prior to 4.0.12

Description October is a Content Management System (CMS) and web platform. A cross-site scripting (XSS) issue exists in October CMS backend configuration forms. A user possessing the Customize Backend Styles permission can inject malicious HTML/JS into the stylesheet input located at Styles within the Branding & Appearance settings. A carefully constructed input can bypass the intended <style> context, potentially enabling arbitrary script execution across backend pages for all users.

Recommendations Update to October version 3.7.13 or later. Update to October version 4.0.12 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-61676

GHSA-WVPQ-H33F-8RP6

Affected Products

October

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61676.json · Exploit
• https://github.com/octobercms/october/security/advisories/GHSA-wvpq-h33f-8rp6 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wvpq-h33f-8rp6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61676 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61676 · Vendor Advisory
• https://github.com/octobercms/october · Note
• https://t.me/CVEtracker/41909 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2009897437847052660 · Twitter Post