CVE-2026-27937

Vulnerability

Overview

CVE-2026-27937 is a reflected Cross-Site Scripting (XSS) vulnerability in the October CMS backend DataTable widget. The flaw arises because a query parameter is rendered in the response without proper output escaping, allowing an attacker to inject arbitrary HTML and JavaScript into the page [1][3].

Exploitation

Prerequisites

Exploitation requires an authenticated backend user to visit a specially crafted URL. The attacker must know or guess the customizable backend URL prefix, and no direct access to the system is possible without social engineering [3]. The vulnerability is reflected only, meaning the malicious payload is not stored on the server.

Impact

A successful attack enables the attacker to execute arbitrary JavaScript in the context of the victim's backend session. This could lead to actions such as session hijacking, defacement, or theft of sensitive information, but only if the victim interacts with the crafted link [3].

Mitigation

The vulnerability is fixed in October CMS versions 3.7.16 and 4.1.16, where the affected parameter is now properly escaped [1][3]. As workarounds include using a non-default backend URL prefix and implementing a Content Security Policy (CSP) for backend pages [3].