October CMS, Cross-Site Scripting (XSS), Critical

By /

Listen to this Post

The vulnerability occurs in the October CMS backend configuration forms, specifically in the Editor Settings Markup Styles section. A user with the Global Editor Settings permission can inject malicious HTML or JavaScript into the stylesheet input field. This input is intended to be within a

tag and includes arbitrary

  • Restrict permissions: php artisan october:permissions deny

    • How Exploit:

    • Gain access with Global Editor Settings permission.
    • Navigate to Settings → Editor Settings → Markup Styles.
    • Inject malicious payload to break