CVE-2023-44383: October CMS stored XSS by authenticated backend user with improper configuration

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-29 · updated 2026-06-17
Weakness: CWE-79

Description

October is a Content Management System (CMS) and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This issue has been patched in version 3.5.2.

Affected products

octobercms october: from 3.0.0 before 3.5.2 — fixed in 3.5.2

How to fix

Upgrade to a fixed version: octobercms october 3.5.2. Check the vendor advisory for mitigations.

References

https://github.com/octobercms/october/commit/b7eed0bbf54d07ff310fcdc7037a8e8bf1f5043b
https://github.com/octobercms/october/security/advisories/GHSA-rvx8-p3xp-fj3p
https://github.com/octobercms/october/commit/b7eed0bbf54d07ff310fcdc7037a8e8bf1f5043b
https://github.com/octobercms/october/security/advisories/GHSA-rvx8-p3xp-fj3p

Get alerted when CVE-2023-44383 or the next vulnerability affects your stack