low3.1
CVE-2026-27937
October is a Content Management System (CMS) and web platform.
Impact
October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping. This vulnerability is fixed in 3.7.16 and 4.1.16.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | october/system | < 3.7.16 | 3.7.16 |