A reflected Cross‑Site Scripting flaw exists in the backend DataTable widget of October CMS where a query parameter is rendered without proper output escaping. An attacker who can craft a URL to the admin interface can trigger the injection, causing arbitrary client‑side script to run in the context of users who access the page. This may lead to session theft, cookie theft, defacement, or the delivery of malicious payloads to administrators.

The vulnerability affects Octobercms October CMS versions prior to 3.7.16 for the 3.x line and prior to 4.1.16 for the 4.x line. The affected product is listed as octobercms:october.

The CVSS score is 3.1, indicating a low severity impact. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of widespread exploitation. However, the flaw requires the attacker to target the backend, implying that it is exploitable only if an attacker can gain access to an admin user’s session or trick an administrator into visiting the crafted link. The risk is therefore moderate in environments where the backend is exposed to untrusted users but could be higher if administrators frequently open links from untrusted sources.