CVE-2026-25133: October Rain Stored XSS via SVG Filter Bypass
Summary
CVE-2026-25133: October Rain has Stored XSS via SVG Filter Bypass. Affects october/rain across 2 version ranges.
< 3.7.14
>= 4.0.0, < 4.1.10
Fixed in 3.7.14 or 4.1.10, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
October Rain is a popular open-source content management system built on the Laravel framework, designed for developers to create and manage websites easily. It offers a range of features including a media manager for uploading and managing files. However, it has a vulnerability in its SVG sanitization logic that can lead to stored cross-site scripting (XSS) attacks.
Vulnerability Detail
A stored cross-site scripting (XSS) vulnerability exists in the SVG sanitization logic of October Rain. The regex pattern used to strip 'on*' event handler attributes can be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries. This vulnerability allows attackers to upload malicious SVG files through the Media Manager, which can lead to privilege escalation if a superuser views or embeds the malicious SVG. The attack requires authenticated backend access with media upload permissions and is triggered when the SVG is viewed or embedded in a page.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.7.143.7.14composer require october/rain:3.7.14 -
>= 4.0.0, < 4.1.104.1.10composer require october/rain:4.1.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, you can disable SVG uploads by adding 'svg' to the blocked extensions in your media configuration. Additionally, ensure that 'media.clean_vectors' is set to 'true' in your configuration (this is enabled by default).
Conclusion
In summary, CVE-2026-25133 is a stored XSS vulnerability in October Rain that can be exploited through malicious SVG uploads. Users are strongly encouraged to upgrade to the patched versions to mitigate this risk. Workarounds are available for those unable to upgrade immediately.
See every vulnerability recorded for october/rain →
FAQ
CVE-2026-25133 is a vulnerability in October Rain that allows for stored XSS attacks through improperly sanitized SVG files.
If exploited, this vulnerability can allow attackers to execute malicious scripts in the context of a user's browser, potentially leading to data theft or privilege escalation.
Versions 3.7.13 and earlier, as well as 4.1.9 and earlier, are affected by this vulnerability.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can access the Vulert playground at Vulert Scanner without any signup.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for october/rain.
