GHSA-wvpq-h33f-8rp6 October CMS Vulnerable to Stored XSS via Branding Styles

• Packagist october/system: < 3.7.13 → fixed in 3.7.13 • Packagist october/system: >= 4.0.0, < 4.0.12 → fixed in 4.0.12

A cross-site scripting (XSS) vulnerabilities was identified in October CMS backend configuration forms: • Branding and Appearances Styles A user with the `Customize Backend Styles` permission could inject malicious HTML/JS into the stylesheet input at *Settings → Branding & Appearance → Styles*. A specially crafted input could break out of the intended `` context, allowing arbitrary script execution across backend pages for all users. --- Impact • Persistent XSS across the backend interface. • Exploitable by lower-privileged accounts with the above permissions. • Potential consequences include privilege escalation, session hijacking, and execution of unauthorized actions in victim sessions. --- Patches The vulnerability has been patched in v4.0.12 and v3.7.13. Stylesheet inputs are now sanitized to prevent injection of arbitrary HTML/JS. All users are strongly encouraged to upgrade to the latest patched version. --- Workarounds If upgrading immediately is not possible: • Restrict the permissions `Customize Backend Styles` to fully trusted administrators only. This reduces exposure but does not fully eliminate risk. --- Credits • Reported by Nakkouch Tarek