PT-2026-32726 · Froala · Froala

Chris Alupului · Published 2026-04-14 · Updated 2026-04-15 · CVE-2026-24906

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions October versions prior to 3.7.14 October versions prior to 4.1.10

Description A stored Cross-Site Scripting (XSS) issue exists in the Backend Editor Settings. The Markup Classes fields, which are used for paragraph, inline, and table styles, fail to sanitize input for valid CSS class name characters. This allows malicious values to be rendered unsanitized in Froala editor dropdown menus, leading to JavaScript execution when a user opens a RichEditor. This requires authenticated backend access with editor settings permissions and could result in privilege escalation if a superuser opens a RichEditor during routine content editing, such as editing a blog post.

Recommendations Update to version 3.7.14 or newer. Update to version 4.1.10 or newer. Restrict editor settings permissions to fully trusted administrators only.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-24906

GHSA-6QMH-J78V-FFP7

Affected Products

Froala

References · 5

• https://github.com/octobercms/october/security/advisories/GHSA-6qmh-j78v-ffp7 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6qmh-j78v-ffp7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24906 · Security Note
• https://github.com/octobercms/october · Note
• https://twitter.com/CVEnew/status/2044358549267001513 · Twitter Post