PT-2026-32912 · October · October

Daftspunk · Published 2026-04-14 · Updated 2026-04-15 · CVE-2026-25133

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions October versions prior to 3.7.14 October versions prior to 4.1.10

Description A stored cross-site scripting (XSS) issue exists in the SVG sanitization logic. The regex pattern used to strip event handler attributes, such as onclick or onload, can be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries. This allows malicious SVG files with embedded JavaScript to be uploaded through the Media Manager. Exploitation requires authenticated backend access with media.library.create permissions and occurs when the SVG is viewed or embedded in a page. This could lead to privilege escalation if a superuser views the file.

Recommendations Update to version 3.7.14. Update to version 4.1.10. Disable SVG uploads by adding svg to the blocked extensions in media configuration. Set media.clean vectors to true in configuration.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-25133

GHSA-GCQV-F29M-67GR

Affected Products

October

References · 5

• https://osv.dev/vulnerability/GHSA-gcqv-f29m-67gr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25133 · Security Note
• https://github.com/octobercms/october · Note
• https://github.com/octobercms/october/security/advisories/GHSA-gcqv-f29m-67gr · Note
• https://twitter.com/CVEnew/status/2044338932800958816 · Twitter Post