Octobercms October vulnerabilities

CVE-2017-1000195 [HIGH] CWE-502 CVE-2017-1000195: October CMS build 412 is vulnerable to PHP object injection in asset move functionality resulting in October CMS build 412 is vulnerable to PHP object injection in asset move functionality resulting in ability to delete files limited by file permissions on the server.

CVE-2021-41126 [HIGH] CWE-287 CVE-2021-41126: October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework. In affected versions administrator accounts which had previously been deleted may still be able to sign in to the backend using October CMS v2.0. The issue has been patched in v2.1.12 of the october/october package. There are no workarounds for this i

CVE-2026-22692 [MEDIUM] CWE-284 CVE-2026-22692: October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to

CVE-2026-26274 [MEDIUM] CWE-184 CVE-2026-26274: October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a vulnera October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a vulnerability was identified in the Twig sandbox security policy that allowed database write operations when cms.safe_mode is enabled. Backend users with Developer permissions could use Twig template markup to execute insert, update, and delete operations on

CVE-2023-25365 [HIGH] CWE-434 CVE-2023-25365: Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arb Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3

CVE-2020-26231 [MEDIUM] CVE-2020-26231: October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypas October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-15247 (fixed in 1.0.469 and 1.1.0) was discovered that has the same impact as CVE-2020-15247. An authenticated backend user with the cms.manage_pages, cms.manage_layouts, or cms.manage_partials permissions who would normally not be permitted to

CVE-2020-15128 [MEDIUM] CWE-565 CVE-2020-15128: In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cooki In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code (nothing exploitable in the core project itself) had a higher chance of succeeding. Specifically, if your

CVE-2023-37692 [MEDIUM] CWE-79 CVE-2023-37692: An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary c An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file.

CVE-2026-26067 [MEDIUM] CWE-184 CVE-2026-26067: October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a server- October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft .less, .sass, or .scss files that leverage the compiler's import functionality to read arbitrary file

CVE-2023-44383 [MEDIUM] CWE-79 CVE-2023-44383: October is a Content Management System (CMS) and web platform to assist with development workflow. A October is a Content Management System (CMS) and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This issue has been patched in version 3.5.2.

CVE-2026-24906 [MEDIUM] CWE-79 CVE-2026-24906: October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 c October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a Stored Cross-Site Scripting (XSS) vulnerability in the Backend Editor Settings. The Markup Classes fields (used for paragraph styles, inline styles, table styles, etc.) did not sanitize input to valid CSS class name characters. Malicious value

CVE-2026-25125 [MEDIUM] CWE-94 CVE-2026-25125: October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 c October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a server-side information disclosure vulnerability in the INI settings parser. Because PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation, attackers with Editor access could inject patterns such as ${APP

CVE-2020-15249 [MEDIUM] CWE-79 CVE-2020-15249: October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In Octo October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, backend users with access to upload files were permitted to upload SVG files without any sanitization applied to the uploaded files. Since SVG files support being parsed as HTML by browsers, this

CVE-2022-23655 [MEDIUM] CWE-347 CVE-2022-23655: Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of Oc Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private keys. Users are advised to upgrade their installations to build 474 or v1.1.10. The only known workaround is to m

CVE-2020-5296 [MEDIUM] CWE-73 CVE-2020-5296: In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attack In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to delete arbitrary local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).

CVE-2020-15247 [MEDIUM] CWE-862 CVE-2020-15247: October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In Octo October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, an authenticated backend user with the cms.manage_pages, cms.manage_layouts, or cms.manage_partials permissions who would normally not be permitted to provide PHP code to be executed by the CMS

CVE-2024-51991 [MEDIUM] CWE-434 CVE-2024-51991: October is a Content Management System (CMS) and web platform. A vulnerability in versions prior to October is a Content Management System (CMS) and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administrators with sites that have the `media.clean_vectors` configuration enabled. This configuration will sanitize SVG files uploaded using the media manager. This vulnerability allows an authenticated user to bypass this

CVE-2026-24907 [MEDIUM] CWE-79 CVE-2026-24907: October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 c October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a stored cross-site scripting (XSS) vulnerability in the Event Log mail preview feature. When viewing logged mail messages, HTML content was rendered in an iframe without proper sandboxing, allowing JavaScript execution in the viewer's browser c

CVE-2023-44381 [MEDIUM] CWE-94 CVE-2023-44381: October is a Content Management System (CMS) and web platform to assist with development workflow. A October is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `editor.cms_pages`, `editor.cms_layouts`, or `editor.cms_partials` permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to `cms.safe_mode` being enabled can craft a spec

CVE-2017-1000193 [MEDIUM] CWE-79 CVE-2017-1000193: October CMS build 412 is vulnerable to stored WCI (a.k.a XSS) in brand logo image name resulting in October CMS build 412 is vulnerable to stored WCI (a.k.a XSS) in brand logo image name resulting in JavaScript code execution in the victim's browser.