Detections
Analytics

SCA: security update for october/rain (GHSA-gcqv-f29m-67gr)

medium Tenable Cloud Security Plugin ID 440380

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain
 a stored cross-site scripting (XSS) vulnerability in the SVG sanitization logic. The regex pattern used to
 strip event handler attributes (such as onclick or onload) could be bypassed using a crafted payload that
 exploits how the pattern matches attribute boundaries, allowing malicious SVG files to be uploaded through
 the Media Manager with embedded JavaScript. Exploitation could lead to privilege escalation if a superuser
 views or embeds the malicious SVG, and requires authenticated backend access with media upload
 permissions. The SVG must be viewed or embedded in a page for the payload to trigger. This issue has been
 fixed in versions 3.7.14 and 4.1.10. (CVE-2026-25133)

Solution

Update the october/rain library and its related packages to version 3.7.14 or later.

See Also

https://github.com/advisories/GHSA-gcqv-f29m-67gr

Plugin Details

Severity: Medium

ID: 440380

Version: Revision 1.10

Type: Local

Family: SCA Checks

Published: 4/15/2026

Updated: 6/16/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.42

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 3.5

Vector: CVSS2#AV:N/AC:L/Au:M/C:P/I:P/A:N

CVSS Score Source: CVE-2026-25133

CVSS v3

Risk Factor: Medium

Base Score: 4.8

Temporal Score: 4.2

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 4.8

Threat Score: 1.1

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/14/2026

Vulnerability Publication Date: 4/14/2026

Reference Information

CVE: CVE-2026-25133

cwe: CWE-79