Media

October CMS stored XSS by authenticated backend user with improper configuration

Publicada: 29.11.2023
Actualizado: 11.10.2026 10:22

Impact

A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported.

SVG files are supported by default in v3 for convenience; however, this has resulted in multiple mistaken vulnerability reports from security researchers. As per the documentation, if a backend user is not trusted, the advice is to remove the svg extension from the list of supported file types.

Patches

The issue has been patched in v3.5.2 by including an SVG sanister. It is enabled by default for new installations but must be enabled for existing sites in the config/media.php file.

'clean_vectors' => true,

Workarounds

If you cannot upgrade for this patch, follow the pervious advice and remove svg from the supported file types.

References

https://github.com/octobercms/october/blob/3.x/config/media.php

Credits to:

Faris Krivic
Okan Kurtulus
Aldin Visnjic
Bug Shankar

For more information

If you have any questions or comments about this advisory:

Email us at hello@octobercms.com

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Paquete de Composer	october/system	>= 3.0.0, < 3.5.2	3.5.2

Referencias

Puntuación CVSS 5.4/10

Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Debilidad (CWE): CWE-79
Plataforma: Composer
Paquete: october/system
Publicada: 29.11.2023
Actualizado: 11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-rvx8-p3xp-fj3p - CC BY 4.0

Historial de vulnerabilidades: october/system

Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (25) en el archivo

Entradas en total: 25
Primera → última: 06.2020 09.2026
Sin corrección: 0
Explotada en ataques: 1

Distribución por gravedad

Crítica 1
Alta 8
Media 9
Baja 7

Divulgaciones por año

2020: 1
2021: 3
2022: 6
2023: 3
2024: 2
2025: 1
2026: 9

29.11.2023

October CMS stored XSS by authenticated backend user with improper configuration esta entrada

Media · 5.4 CVE-2023-44383 >= 3.0.0, < 3.5.2 3.5.2
29.11.2023

October CMS safe mode bypass using Twig sandbox escape

Crítica · 9.1 CVE-2023-44382 >= 3.0.0, < 3.4.15 3.4.15
13.10.2022

October CMS Safe Mode bypass leads to authenticated Remote Code Execution

Alta · 7.2 CVE-2022-35944 >= 2.0.0, < 2.2.34, >= 3.0.0, < 3.0.66 2.2.34, 3.0.66
13.07.2022

October CMS upload process vulnerable to RCE via Race Condition

Alta · 8.1 CVE-2022-24800 < 1.0.476, >= 1.1.0, < 1.1.12, >= 2.0.0, < 2.2.15 1.0.476, 1.1.12, 2.2.15
23.02.2022

Authenticated remote code execution in October CMS

Alta · 7.2 CVE-2022-21705 < 1.0.474, >= 1.1.0, < 1.1.10, >= 2.0.0, < 2.1.27 1.0.474, 1.1.10, 2.1.27
14.01.2022

october/system arbitrary code execution

Alta · 8.8 CVE-2021-32650 >= 1.1.0, < 1.1.6, < 1.0.473 1.1.6, 1.0.473
14.01.2022

October/System authenticated file write leads to remote code execution

Alta · 8.8 CVE-2021-32649 >= 1.1.0, < 1.1.6, < 1.0.473 1.1.6, 1.0.473
06.10.2021

Deleted Admin Can Sign In to Admin Interface

Alta · 7.2 CVE-2021-41126 >= 2.1.0, < 2.1.12 2.1.12
30.08.2021

October CMS auth bypass and account takeover

Alta · 7.4 CVE-2021-29487 < 1.0.472, >= 1.1.1, < 1.1.5 1.0.472, 1.1.5
30.08.2021

Account Takeover in Octobercms

Alta · 8.2 Explotada en ataques CVE-2021-32648 < 1.0.472, >= 1.1.1, < 1.1.5 1.0.472, 1.1.5

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación