Stored XSS in October CMS enables malicious PDF uploads

October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system. If the file is accessed through the website, it could lead to a Cross-Site Scripting (XSS) attack or execute arbitrary code via a crafted JavaScript to the target.

• October CMS from vendor octobercms: version 3.6.30 is confirmed affected. • The relevant functionality is the media upload area, including the Documents upload flow. • No specific fixed release is provided in the available evidence. The status of other branches or versions is not confirmed.

The flaw is in the administrative media upload functionality. An authenticated administrator can upload a PDF containing malicious JavaScript; the public analysis identifies the related area as admin/media and the Documents upload flow. When the file is opened through the website, JavaScript stored in the file may execute in the browser, resulting in stored Cross-Site Scripting (XSS). The available source also describes possible arbitrary code execution through crafted JavaScript, but it does not establish whether this means server-side code execution or define a more specific execution path beyond accessing the file through the website.

The attack is reachable through the web interface and requires an authenticated administrator account to upload the file. The file must then be accessed through the website by a user or browser for the JavaScript to execute, so user interaction is required at the execution stage. A public proof of concept has been published in a third-party technical analysis. The available evidence does not confirm exploitation in the wild, a specific campaign, or a named victim.

The flaw can create stored XSS when a PDF containing malicious JavaScript is opened through the website. The direct technical outcome may include modifying page content or performing actions in the browser context of the user who accesses the file. The source also describes possible arbitrary code execution, but the evidence is insufficient to determine whether execution occurs on the server, which privileges would apply, or how far the impact extends. Uploading the file requires an authenticated administrator account, while triggering the content requires a user or browser to access the PDF; the current record does not establish confidentiality or availability impact.

• Users who open a malicious PDF may have unexpected JavaScript run in their browser session, allowing page content or behavior to be altered. • Integrity or session-related effects are possible if the script executes in a context with suitable permissions. • The source describes possible arbitrary code execution, but the actual scope and whether this reaches server-side execution are not established. • The record does not establish data disclosure, service disruption, system takeover, or a specific incident.

1. Identify and address October CMS deployments running version 3.6.30; do not treat a later version as fixed unless the vendor confirms it.
2. Because the available evidence does not provide a fixed release or patch, follow the vendor's official update guidance and move to a release explicitly confirmed to remediate the issue.
3. Until a confirmed fix is available, restrict access to the administrative file-upload functionality and prevent untrusted PDFs from being served to users where operationally feasible.
4. Review previously uploaded PDFs and remove suspicious files from public access. Reassess administrator accounts that can upload files and reduce permissions where appropriate.

1. Inventory October CMS deployments and verify the installed version against the confirmed affected release.
2. Review admin/media, the Documents area, and PDF upload history for unexpected files or uploads made by administrator accounts.
3. Inspect PDFs served through the website for embedded JavaScript or other unexpected active content, using an isolated analysis environment.
4. Review access records for uploaded PDFs that were subsequently opened through the website as a precaution. This is not a source-confirmed IOC, and the absence of matching log evidence does not prove that a system is safe.