October CMS stores user‑provided SVG files after sanitization. A regular expression used to strip event handler attributes can be tricked with a specially crafted payload that exploits attribute boundary detection. When a malicious SVG file containing JavaScript is uploaded through the Media Manager, the script runs whenever the file is viewed or embedded, allowing an attacker with backend upload permissions to execute arbitrary code in a superuser context, effectively achieving privilege escalation.

October CMS versions older than 3.7.14 and 4.1.10 are affected. The vulnerability exists in the core SVG sanitization logic and is present in the October CMS product only.

The CVSS score of 4.8 indicates moderate risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to be authenticated with media upload rights and to trigger the SVG in a browser. Because the payload is stored and only activates upon viewing, the attack vector is authenticated file upload combined with user interaction with the compromised media.