OctoberCMS is affected by a stored XSS vulnerability (CWE-79) in its SVG sanitization logic in versions before 3.7.14 and 4.1.10. The regex intended to strip event handler attributes like onclick or onload can be bypassed, allowing malicious JavaScript embedded in SVG files uploaded through the Media Manager. Exploitation requires authenticated backend access with media upload permissions and triggers when the malicious SVG is viewed or embedded, potentially escalating privileges if a superuser is targeted. The vulnerability is addressed in OctoberCMS versions 3.7.14 and 4.1.10.

Successful exploitation allows an authenticated user with media upload permissions to upload malicious SVG files containing JavaScript, which can execute when viewed or embedded, potentially leading to privilege escalation involving superuser accounts. The CVSS score of 4.8 indicates a medium severity impact with network attack vector, low complexity, and required privileges. There are no known exploits in the wild at this time.

This vulnerability has been fixed in OctoberCMS versions 3.7.14 and 4.1.10. Users should upgrade to these or later versions to remediate the issue. Since the vulnerability requires authenticated backend access with media upload permissions, limiting such access can reduce risk until patching is applied. Patch status is not explicitly stated as 'official-fix' in the vendor advisory, but the fixed versions indicate an official remediation is available.