CVE-2025-61676: October CMS Vulnerable to Stored XSS via Branding Styles

January 9, 2026 (updated January 11, 2026)

A cross-site scripting (XSS) vulnerabilities was identified in October CMS backend configuration forms:

Branding and Appearances Styles A user with the Customize Backend Styles permission could inject malicious HTML/JS into the stylesheet input at Settings → Branding & Appearance → Styles.

A specially crafted input could break out of the intended <style> context, allowing arbitrary script execution across backend pages for all users.

References

github.com/advisories/GHSA-wvpq-h33f-8rp6
github.com/octobercms/october
github.com/octobercms/october/security/advisories/GHSA-wvpq-h33f-8rp6
nvd.nist.gov/vuln/detail/CVE-2025-61676

Code Behaviors & Features

Detect and mitigate CVE-2025-61676 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →