CVE-2026-27937
October: Reflected XSS via DataTable Form Widget
October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping. This vulnerability is fixed in 3.7.16 and 4.1.16.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
October: Reflected XSS via DataTable Form Widget
October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping. This vulnerability is fixed in 3.7.16 and 4.1.16.
- Record
CVE-2026-27937- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-24157
October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping. This vulnerability is fixed in 3.7.16 and 4.1.16.
- Record
EUVD-2026-24157- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jj38-h5w5-mvpf
October CMS: Reflected XSS via DataTable Form Widget
A reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping.
Impact
- Reflected XSS only, no stored/persistent component
- The backend URL prefix is customizable and must be known or guessed by the attacker
- Requires an authenticated backend user to visit a crafted URL
- No direct access is gained without social engineering
Patches
The vulnerability has been patched in v3.7.16 and v4.1.16. The affected parameter is now properly escaped. All users are encouraged to upgrade to the latest patched version.
Workarounds
- Use a non-default backend URL prefix (recommended as standard practice)
- Implement a Content Security Policy (CSP) for backend pages
- Record
GHSA-jj38-h5w5-mvpf- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping. This vulnerability is fixed in 3.7.16 and 4.1.16.
- Record
CVE-2026-27937- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-jj38-h5w5-mvpf
October CMS: Reflected XSS via DataTable Form Widget
A reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping.
Impact
- Reflected XSS only, no stored/persistent component
- The backend URL prefix is customizable and must be known or guessed by the attacker
- Requires an authenticated backend user to visit a crafted URL
- No direct access is gained without social engineering
Patches
The vulnerability has been patched in v3.7.16 and v4.1.16. The affected parameter is now properly escaped. All users are encouraged to upgrade to the latest patched version.
Workarounds
- Use a non-default backend URL prefix (recommended as standard practice)
- Implement a Content Security Policy (CSP) for backend pages
- Record
GHSA-jj38-h5w5-mvpf- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
october/systemPackagist |
before 3.7.16 | 3.7.16 |
october/systemPackagist |
4.0.0 up to 4.1.16 | 4.1.16 |
october/systemPackagist |
before 3.7.16, plus listed versions v1.0.319v1.0.320v1.0.321v1.0.322v1.0.323 Show 45 moreShow lessv1.0.324v1.0.325v1.0.326v1.0.327v1.0.328v1.0.329v1.0.330v1.0.331v1.0.332v1.0.333v1.0.334v1.0.335v1.0.336v1.0.337v1.0.338v1.0.339v1.0.340v1.0.341v1.0.342v1.0.343v1.0.344v1.0.345v1.0.346v1.0.347v1.0.348v1.0.349v1.0.350v1.0.351v1.0.352v1.0.353v1.0.354v1.0.355v1.0.356v1.0.357v1.0.358v1.0.359v1.0.360v1.0.361v1.0.362v1.0.363v1.0.364v1.0.365v1.0.366v1.0.367v1.0.368 |
3.7.16 |
october/systemPackagist |
4.0.0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-27937 is a low vulnerability (CVSS 3.1) in Octobercms October, published April 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in october/system 3.7.16.
References
Left out here: 119 versions. The JSON record has them.