CVE-2026-24906 October CMS has Stored XSS in its Backend Editor Markup Classes
Authenticated attackers can inject malicious scripts into backend editor settings, leading to code execution and privilege escalation when victims open rich text editors.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-24906?
CVE-2026-24906 is a medium-severity cross-site scripting vulnerability in Octobercms October, published on 14 Apr 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a Stored Cross-Site Scripting (XSS) vulnerability in the Backend Editor Settings. The Markup Classes fields (used for paragraph styles, inline styles, table styles, etc.) did not sanitize input to valid CSS class name characters. Malicious values were rendered unsanitized in Froala editor dropdown menus, allowing JavaScript execution when any user opened a RichEditor. Exploitation could lead to privilege escalation if a superuser opens any RichEditor during routine content editing (e.g., editing a blog post), and requires authenticated backend access with editor settings permissions. This issue has been fixed in versions 3.7.14 and 4.1.10. To workaround this issue, restrict editor settings permissions to fully trusted administrators only
Weakness: CWE-79
Which versions are affected by CVE-2026-24906?
4 open source packages ship an affected version, including october/system. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
october/system Packagist | All versions | 3.7.14 |
october/system Packagist | All versions | 3.7.14 |
october/system Packagist | From 4.0.0 | 4.1.10 |
october/system Packagist | From 4.0.0 | 4.1.10 |
Products include Octobercms October.
How do I fix CVE-2026-24906?
Upgrade october/system to a fixed version for your release line: 3.7.14 or 4.1.10.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-24906 being exploited?
There is no known exploitation of CVE-2026-24906 in the wild and no public exploit code.
Other vulnerabilities in Octobercms October
Sources
Also known as GHSA-6qmh-j78v-ffp7.