CVE-2026-27937: October CMS Reflected XSS Vulnerability in DataTable Widget
Summary
CVE-2026-27937: October CMS: Reflected XSS via DataTable Form Widget. Affects october/system across 2 version ranges.
< 3.7.16
>= 4.0.0
Fixed in 3.7.16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
October CMS is a popular open-source content management system built on the Laravel PHP framework. It provides a flexible platform for developers to create and manage websites with ease. The system includes various widgets and components, one of which is the DataTable widget, used for displaying tabular data in the backend. This widget is essential for managing data efficiently but has been found to have a security flaw that could lead to reflected cross-site scripting (XSS) attacks.
Vulnerability Detail
A reflected Cross-Site Scripting (XSS) vulnerability exists in the backend DataTable widget of October CMS. This issue arises when a query parameter is rendered without proper output escaping, allowing attackers to inject malicious scripts into the application. The vulnerability requires an authenticated backend user to visit a crafted URL, making it necessary for the attacker to employ social engineering tactics to exploit the flaw. The impact is limited to reflected XSS, with no stored or persistent component, but it poses a risk to user data integrity and application security.
How To Fix
Minimum fixed version
3.7.16
This is the first release that contains the fix.
composer require october/system:3.7.16Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to implement a non-default backend URL prefix as a standard practice. Additionally, implementing a Content Security Policy (CSP) for backend pages can help mitigate the risk of XSS attacks.
Conclusion
The reflected XSS vulnerability in the October CMS DataTable widget poses a risk to authenticated users, necessitating prompt action to mitigate potential exploitation. Users are encouraged to upgrade to the latest patched versions and consider implementing additional security measures.
See every vulnerability recorded for october/system →
FAQ
Reflected XSS is a type of cross-site scripting attack where malicious scripts are injected into a web application and executed immediately, typically through a crafted URL.
Any authenticated user of the October CMS backend who visits a maliciously crafted URL is at risk of being affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate upgrading is not possible, consider implementing a non-default backend URL prefix and a Content Security Policy (CSP) to reduce the risk of exploitation.
The CVSS score of this vulnerability is 3.1, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for october/system.
