CVE-2026-24906: falha de média gravidade em octobercms october
October CMS has Stored XSS in its Backend Editor Markup Classes
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1epss 0.3%
October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a Stored Cross-Site Scripting (XSS) vulnerability in the Backend Editor Settings. The Markup Classes fields (used for paragraph styles, inline styles, table styles, etc.) did not sanitize input to valid CSS class name characters. Malicious values were rendered unsanitized in Froala editor dropdown menus, allowing JavaScript execution when any user opened a RichEditor. Exploitation could lead to privilege escalation if a superuser opens any RichEditor during routine content editing (e.g., editing a blog post), and requires authenticated backend access with editor settings permissions. This issue has been fixed in versions 3.7.14 and 4.1.10. To workaround this issue, restrict editor settings permissions to fully trusted administrators only
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
octobercms · octoberCVEs relacionadas — octobercms october
No mesmo produto, das mais perigosas para as menos.
CVE-2021-32648HIGHAccount Takeover in OctobercmsEPSS 91.2%KEVCVE-2022-21705HIGHAuthenticated remote code execution in octobercmsEPSS 8.6%CVE-2020-5295MEDIUMLocal File read vulnerability in OctoberCMSEPSS 7.4%CVE-2021-32650HIGHArbitrary code execution in october/systemEPSS 2.2%CVE-2021-21265MEDIUMOctober CMS vulnerable to Potential Host Header Poisoning on misconfigured serversEPSS 1.7%CVE-2020-15246HIGHLocal File Inclusion by unauthenticated usersEPSS 1.7%