CVE-2025-61674: October CMS Vulnerable to Stored XSS via Editor and Branding Styles
A cross-site scripting (XSS) vulnerabilities was identified in October CMS backend configuration forms:
- Editor Settings Markup Styles A user with the Global Editor Settings permission could inject malicious HTML/JS into the stylesheet input at Settings → Editor Settings → Markup Styles.
A specially crafted input could break out of the intended <style> context, allowing arbitrary script execution across backend pages for all users.
---
Impact - Persistent XSS across the backend interface. - Exploitable by lower-privileged accounts with the above permissions. - Potential consequences include privilege escalation, session hijacking, and execution of unauthorized actions in victim sessions.
---
Patches The vulnerability has been patched in v4.0.12 and v3.7.13. Stylesheet inputs are now sanitized to prevent injection of arbitrary HTML/JS.
All users are strongly encouraged to upgrade to the latest patched version.
---
Workarounds If upgrading immediately is not possible: - Restrict the permissions Global Editor Settings to fully trusted administrators only.
This reduces exposure but does not fully eliminate risk.
---
Credits - Reported by Nakkouch Tarek
Other sources
October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting (XSS) vulnerability was identified in October CMS backend configuration forms. A user with the Global Editor Settings permission could inject malicious HTML/JS into the stylesheet input at Markup Styles. A specially crafted input could break out of the intended <style> context, allowing arbitrary script execution across backend pages for all users. This issue has been patched in versions 3.7.13 and 4.0.12.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61674?
CVE-2025-61674 is classified as a cross-site scripting (XSS) vulnerability that can be exploited by users with Global Editor Settings permissions.
How do I fix CVE-2025-61674?
To resolve CVE-2025-61674, update the October CMS to version 4.0.12 or 3.7.13.
Who is affected by CVE-2025-61674?
Users with the Global Editor Settings permissions in October CMS versions prior to 4.0.12 and 3.7.13 are affected by CVE-2025-61674.
What can an attacker do with CVE-2025-61674?
An attacker can inject malicious HTML/JS into the stylesheet input, possibly leading to unauthorized actions or data exposure.
Where can I find more information about CVE-2025-61674?
Further details on CVE-2025-61674 can be found in security advisories from the October CMS GitHub repository.