Package Instance

Improper Verification of Cryptographic Signature
Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS does not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private keys.

October CMS Allows Unprotected SVG Rename in Media Manager
This advisory affects authenticated administrators with sites that have the `media.clean_vectors` configuration enabled. This configuration will sanitize SVG files uploaded using the media manager. This vulnerability allows an authenticated user to bypass this protection by uploading it with a permitted extension (for example, .jpg or .png) and later modifying it to the .svg extension.

This vulnerability assumes a trusted user will attack another trusted user and cannot be actively exploited without access to the administration panel and interaction from the other user.

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass `cms.safe_mode` / `cms.enableSafeMode` in order to execute arbitrary code. This issue only affects admin panels that rely on safe mode and restricted permissions. To exploit this vulnerability, an attacker must first have access to the backend area. The issue has been patched in Build 474 (v1.0.474) and v1.1.10.

Improper Authentication
octobercms in a CMS platform based on the Laravel PHP Framework. There exists a vulnerability that is exploitable by unauthenticated users via a specially crafted request. This only affects frontend users and the attacker must obtain a Laravel secret key for cookie encryption and signing in order to exploit this vulnerability.

October CMS has Safe Mode Bypass via CSS Preprocessor Compilers
A server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft `.less`, `.sass`, or `.scss` files that leverage the compiler's import functionality to read arbitrary files from the server. This worked even with `cms.safe_mode` enabled.

### Impact
- Potential exposure of sensitive server-side files
- Requires authenticated backend access with Editor permissions
- Only relevant when `cms.safe_mode` is enabled (otherwise direct PHP injection is already possible)

### Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. When `cms.safe_mode` is enabled, `.less`, `.sass`, and `.scss` files can no longer be created, uploaded, or edited across the CMS editor, media manager, and file upload interfaces. All users are encouraged to upgrade to the latest patched version.

### Workarounds
If upgrading immediately is not possible:
- Set `cms.editable_asset_types` config to `['css', 'js']` to remove preprocessor file types from the editor
- Restrict Editor tool access to fully trusted administrators only

- Reported by [Chris Alupului](https://github.com/neosprings)

October CMS Vulnerable to Stored XSS via Branding Styles
A cross-site scripting (XSS) vulnerabilities was identified in October CMS backend configuration forms:

- **Branding and Appearances Styles**
A user with the `Customize Backend Styles` permission could inject malicious HTML/JS into the stylesheet input at
*Settings → Branding & Appearance → Styles*.

A specially crafted input could break out of the intended `<style>` context, allowing arbitrary script execution across backend pages for all users.

---

October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations
Fine-grained sub-permission checks for asset and blueprint file operations were not enforced in the CMS and Tailor editor extensions. This only affects backend users who were explicitly granted `editor` access but had `editor.cms_assets` or `editor.tailor_blueprints` specifically withheld, an uncommon permission configuration. In this edge case, such users could perform file operations (create, delete, rename, move, upload) on theme assets or blueprint files despite lacking the required sub-permission. A related operator precedence error in the Tailor navigation also disclosed the theme blueprint directory tree under the same conditions.

### Impact
- Only exploitable by authenticated backend users with `editor` access who have been specifically denied the `editor.cms_assets` or `editor.tailor_blueprints` sub-permissions
- Does not affect default permission configurations where editor users typically have all sub-permissions granted
- Users without `editor.cms_assets` could manipulate theme asset files (delete, rename, move, upload, create directories)
- Users without `editor.tailor_blueprints` could manipulate blueprint files (delete, rename, move, upload, create directories)
- Users without `editor.tailor_blueprints` could view the theme blueprint navigation tree, disclosing file paths and directory structure

### Patches
The vulnerability has been patched in v3.7.16 and v4.1.16. Fine-grained document type permission checks are now enforced on all asset and blueprint file operation commands, and the navigation node condition logic has been corrected. All users are encouraged to upgrade to the latest patched version.

### Workarounds
- Restrict the `editor` permission to fully trusted administrators only
- Remove the `editor` permission from any user who should not have asset or blueprint management access

Weak Password Recovery Mechanism for Forgotten Password
octobercms in a CMS platform based on the Laravel PHP Framework. An attacker can request an account password reset and then gain access to the account using a specially crafted request.

October CMS upload process vulnerable to RCE via Race Condition
### Impact

This advisory affects plugins that expose the `October\Rain\Database\Attach\File::fromData` as a public interface. This vulnerability does not affect vanilla installations of October CMS since this method is not exposed or used by the system internally or externally.

When the developer allows the user to specify their own filename in the `fromData` method, an unauthenticated user can perform remote code execution (RCE) by exploiting a race condition in the temporary storage directory.

### Patches

The issue has been patched in Build 476 (v1.0.476) and v1.1.12 and v2.2.15.

### Workarounds

Apply https://github.com/octobercms/library/commit/fe569f3babf3f593be2b1e0a4ae0283506127a83 to your installation manually if unable to upgrade to Build 476 (v1.0.476) or v1.1.12 or v2.2.15.

### References

Credits to:
- DucNT, HungTD and GiangVQ from RedTeam@VNG Security Response Center.

### For more information

If you have any questions or comments about this advisory:
- Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

October CMS Vulnerable to Stored XSS via Editor and Branding Styles
A cross-site scripting (XSS) vulnerabilities was identified in October CMS backend configuration forms:

- **Editor Settings Markup Styles**
A user with the `Global Editor Settings` permission could inject malicious HTML/JS into the stylesheet input at
*Settings → Editor Settings → Markup Styles*.

A specially crafted input could break out of the intended `<style>` context, allowing arbitrary script execution across backend pages for all users.

---

October CMS Safe Mode bypass leads to authenticated Remote Code Execution
### Impact

This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin panel and permission to open the "Editor" section, they can bypass the Safe Mode (`cms.safe_mode`) restriction to introduce new PHP code in a CMS template using a specially crafted request.

### Patches

The issue has been patched in v2.2.34 and v3.0.66

### References

Credits to:

-  David Miller

### For more information

If you have any questions or comments about this advisory:

- Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework., an attacker with "create, modify and delete website pages" privileges in the backend is able to execute PHP code by running specially crafted Twig code in the template markup. The issue has been patched in Build (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround.

October CMS: Reflected XSS via DataTable Form Widget
A reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping.

### Impact
- Reflected XSS only, no stored/persistent component
- The backend URL prefix is customizable and must be known or guessed by the attacker
- Requires an authenticated backend user to visit a crafted URL
- No direct access is gained without social engineering

### Patches
The vulnerability has been patched in v3.7.16 and v4.1.16. The affected parameter is now properly escaped. All users are encouraged to upgrade to the latest patched version.

### Workarounds
- Use a non-default backend URL prefix (recommended as standard practice)
- Implement a Content Security Policy (CSP) for backend pages

October CMS has Stored XSS in Backend Editor Markup Classes
A stored cross-site scripting (XSS) vulnerability was identified in the Backend Editor Settings. The Markup Classes fields (used for paragraph styles, inline styles, table styles, etc.) did not sanitize input to valid CSS class name characters. Malicious values were rendered unsanitized in Froala editor dropdown menus, allowing JavaScript execution when any user opened a RichEditor.

### Impact
- Stored XSS via editor settings rendered in RichEditor dropdowns
- Could allow privilege escalation if a superuser opens any RichEditor (e.g., editing a blog post)
- Requires authenticated backend access with editor settings permissions
- Triggers on routine content editing operations

### Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.

### Workarounds
If upgrading immediately is not possible:
- Restrict editor settings permissions to fully trusted administrators only

### References
- Reported by [Chris Alupului](https://github.com/neosprings)

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with access to the backend is able to execute PHP code by using the theme import feature. This will bypass the safe mode feature that prevents PHP execution in the CMS templates.The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround.