OctoberCMS's SVG sanitization logic uses a regex pattern intended to remove event handler attributes such as onclick or onload. However, this pattern can be bypassed with crafted payloads that exploit how attribute boundaries are matched, allowing malicious JavaScript to be embedded in SVG files uploaded via the Media Manager. An attacker with authenticated backend access and media upload permissions can upload such SVGs. When a superuser views or embeds the malicious SVG, the embedded script executes, potentially escalating privileges. Fixed in OctoberCMS versions 3.7.14 and 4.1.10.

The vulnerability allows stored cross-site scripting via malicious SVG uploads, which can lead to privilege escalation if a superuser views or embeds the SVG. The attacker must have authenticated backend access with media upload permissions, limiting the attack surface. The CVSS score is 4.8 (medium severity), reflecting the need for authentication and user interaction for exploitation.

Upgrade OctoberCMS to version 3.7.14 or later, or 4.1.10 or later, where this vulnerability has been fixed. Since the issue is resolved in these versions, applying the official patch is the recommended remediation. No additional mitigations are specified or required beyond upgrading.