CVE-2025-61674
Medium
Description
October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting (XSS) vulnerability was identified in October CMS backend configuration forms. A user with the Global Editor Settings permission could inject malicious HTML/JS into the stylesheet input at Markup Styles. A specially crafted input could break out of the intended <style> context, allowing arbitrary script execution across backend pages for all users. This issue has been patched in versions 3.7.13 and 4.0.12.
SeverityMedium
CVSS6.1
Exploit probability—
ProductOctober
PublishedJan 10, 2026
First seenJan 10, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- octobercms october3.17.3, 4.0.12 or later
- october/system3.7.13, 4.0.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| octobercms october | v < 3.17.3, 4.0.0 ≤ v < 4.0.12 | 3.17.3, 4.0.12 |
| october/systemPackagist | v < 3.7.13, 4.0.0 ≤ v < 4.0.12 | 3.7.13, 4.0.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.