{"id":"CVE-2026-25133","aliases":["GHSA-gcqv-f29m-67gr"],"url":"https://o3.security/vulnerability/CVE-2026-25133","summary":"October CMS has Stored XSS via SVG Filter Bypass","details":"A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip `on*` event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.\n\n### Impact\n- Stored XSS via malicious SVG files uploaded through the Media Manager\n- Could allow privilege escalation if a superuser views or embeds the malicious SVG\n- Requires authenticated backend access with media upload permissions (`media.library.create`)\n- SVG must be viewed or embedded in a page to trigger\n\n### Patches\nThe vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.\n\n### Workarounds\nIf upgrading immediately is not possible:\n- Disable SVG uploads by adding `svg` to the blocked extensions in media configuration\n- Set `media.clean_vectors` to `true` in configuration (enabled by default)\n\n### References\n- Reported by Pentest-Tools.com","published":"2026-04-14T20:47:49.474Z","modified":"2026-10-28T02:30:38.017222796Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"october/rain","fixedVersion":"4.1.10"},{"ecosystem":"Packagist","name":"october/rain","fixedVersion":"3.7.14"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25133.json"},{"type":"ADVISORY","url":"https://github.com/octobercms/october/security/advisories/GHSA-gcqv-f29m-67gr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25133"},{"type":"PACKAGE","url":"https://github.com/octobercms/october"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:38.017222796Z"}}