CVE-2026-27937

Published April 21st, 2026

View on NVD ↗

CVSS v3

3.1

LOW

CVSS v2

N/A

Affected

PROJECT

Description

October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping. This vulnerability is fixed in 3.7.16 and 4.1.16.

octobercms/october

Self-hosted CMS platform based on the Laravel PHP Framework.

GitHub

11.1K