CVE-2020-11083: Stored XSS in October

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-07-14 · updated 2026-06-17
Weakness: CWE-79

Description

In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. This has been fixed in 1.0.466. For users of the RainLab.Blog plugin, this has also been fixed in 1.4.1.

Affected products

octobercms october: from 1.0.319 before 1.0.466 — fixed in 1.0.466

How to fix

Upgrade to a fixed version: octobercms october 1.0.466. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html
http://seclists.org/fulldisclosure/2020/Aug/2
https://github.com/octobercms/october/commit/9ecfb4867baae14a0d3f99f5b5c1e8a979ae8746
https://github.com/octobercms/october/security/advisories/GHSA-w4pj-7p68-3vgv
https://github.com/rainlab/blog-plugin/commit/6ae19a6e16ef3ba730692bc899851342c858bb94
http://packetstormsecurity.com/files/158730/October-CMS-Build-465-XSS-File-Read-File-Deletion-CSV-Injection.html
http://seclists.org/fulldisclosure/2020/Aug/2
https://github.com/octobercms/october/commit/9ecfb4867baae14a0d3f99f5b5c1e8a979ae8746
https://github.com/octobercms/october/security/advisories/GHSA-w4pj-7p68-3vgv
https://github.com/rainlab/blog-plugin/commit/6ae19a6e16ef3ba730692bc899851342c858bb94

Get alerted when CVE-2020-11083 or the next vulnerability affects your stack