What’s Vulnerable › Vulnerabilities

CVE-2024-25637: Reflected XSS via X-October-Request-Handler Header

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-26 · updated 2026-06-17
• Weakness: CWE-79

Description

October is a self-hosted CMS platform based on the Laravel PHP Framework. The X-October-Request-Handler Header does not sanitize the AJAX handler name and allows unescaped HTML to be reflected back. There is no impact since this vulnerability cannot be exploited through normal browser interactions. This unescaped value is only detectable when using a proxy interception tool. This issue has been patched in version 3.5.15.

Affected products

• octobercms october: from 3.2.0 before 3.5.15 — fixed in 3.5.15

How to fix

Upgrade to a fixed version: octobercms october 3.5.15. Check the vendor advisory for mitigations.

References

• https://github.com/octobercms/october/security/advisories/GHSA-rjw8-v7rr-r563
• https://github.com/octobercms/october/security/advisories/GHSA-rjw8-v7rr-r563

Get alerted when CVE-2024-25637 or the next vulnerability affects your stack