GitHub Advisoryadvisory · Packagist

GHSA-jj38-h5w5-mvpf October CMS: Reflected XSS via DataTable Form Widget

LOW Published 2026-04-21 Modified 2026-04-24 Official page ↗
Aliases
CVE-2026-27937
Ecosystem
Packagist
Packages
october/system
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-79
Reviewed
2026-04-21

Affected packages

• Packagist october/system: < 3.7.16 → fixed in 3.7.16 • Packagist october/system: < 4.1.16 (no fix yet)

Description

A reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping. Impact • Reflected XSS only, no stored/persistent component • The backend URL prefix is customizable and must be known or guessed by the attacker • Requires an authenticated backend user to visit a crafted URL • No direct access is gained without social engineering Patches The vulnerability has been patched in v3.7.16 and v4.1.16. The affected parameter is now properly escaped. All users are encouraged to upgrade to the latest patched version. Workarounds • Use a non-default backend URL prefix (recommended as standard practice) • Implement a Content Security Policy (CSP) for backend pages

Related

Alias · CVE (1)

  • CVE-2026-27937 October is a Content Management System (CMS) and web platform. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References