Octobercms October vulnerabilities

CVE-2020-4061 [MEDIUM] CWE-79 CVE-2020-4061: In October from version 1.0.319 and before version 1.0.467, pasting content copied from malicious we In October from version 1.0.319 and before version 1.0.467, pasting content copied from malicious websites into the Froala richeditor could result in a successful self-XSS attack. This has been fixed in 1.0.467.

CVE-2024-25637 [MEDIUM] CWE-79 CVE-2024-25637: October is a self-hosted CMS platform based on the Laravel PHP Framework. The X-October-Request-Hand October is a self-hosted CMS platform based on the Laravel PHP Framework. The X-October-Request-Handler Header does not sanitize the AJAX handler name and allows unescaped HTML to be reflected back. There is no impact since this vulnerability cannot be exploited through normal browser interactions. This unescaped value is only detectable when using a

CVE-2021-21264 [MEDIUM] CVE-2021-21264: October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypas October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-26231 (fixed in 1.0.470/471 and 1.1.1) was discovered that has the same impact as CVE-2020-26231 & CVE-2020-15247. An authenticated backend user with the `cms.manage_pages`, `cms.manage_layouts`, or `cms.manage_partials` permissions who would **

CVE-2018-1999008 [MEDIUM] CWE-79 CVE-2018-1999008: October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Me October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality that can result in an Authenticated user with media module permission creating arbitrary folder name with XSS content. This attack appear to be exploitable via an Authenticated user with media module permi

CVE-2020-5299 [MEDIUM] CWE-77 CVE-2020-5299: In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, any users In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, any users with the ability to modify any data that could eventually be exported as a CSV file from the `ImportExportController` could potentially introduce a CSV injection into the data to cause the generated CSV export file to be malicious. This requires attacke

CVE-2023-43876 [MEDIUM] CWE-79 CVE-2023-43876: A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost field.

CVE-2024-25837 [MEDIUM] CWE-79 CVE-2024-25837: A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower all A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web scripts or HTML via a crafted payload into the Comments section.

CVE-2020-11083 [MEDIUM] CWE-79 CVE-2020-11083: In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWid In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. This has been fixed in 1.0.466. For users of the RainLab.Blog plugin, this has also been fixed i

CVE-2026-25133 [MEDIUM] CWE-79 CVE-2026-25133: October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 c October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a stored cross-site scripting (XSS) vulnerability in the SVG sanitization logic. The regex pattern used to strip event handler attributes (such as onclick or onload) could be bypassed using a crafted payload that exploits how the pattern matches

CVE-2025-61674 [MEDIUM] CWE-79 CVE-2025-61674: October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting (XSS) vulnerability was identified in October CMS backend configuration forms. A user with the Global Editor Settings permission could inject malicious HTML/JS into the stylesheet input at Markup Styles. A specially crafted input

CVE-2025-61676 [MEDIUM] CWE-79 CVE-2025-61676: October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting (XSS) vulnerabilities was identified in October CMS backend configuration forms. A user with the Customize Backend Styles permission could inject malicious HTML/JS into the stylesheet input at Styles from Branding & Appearance set

CVE-2024-24764 [MEDIUM] CWE-601 CVE-2024-24764: October is a self-hosted CMS platform based on the Laravel PHP Framework. This issue affects authent October is a self-hosted CMS platform based on the Laravel PHP Framework. This issue affects authenticated administrators who may be redirected to an untrusted URL using the PageFinder schema. The resolver for the page finder link schema (`october://`) allowed external links, therefore allowing an open redirect outside the scope of the active host.

CVE-2024-45962 [MEDIUM] CWE-79 CVE-2024-45962: October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaS October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system. If the file is accessed through the website, it could lead to a Cross-Site Scripting (XSS) attack or execute arbitrary code via a crafted JavaScript to the target.

CVE-2020-5298 [MEDIUM] CWE-87 CVE-2020-5298: In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user wi In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the `ImportExportController` behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question Issue has been

CVE-2020-15248 [MEDIUM] CWE-863 CVE-2020-15248: October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In Octo October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.470, backend users with the default "Publisher" system role have access to create & manage users where they can choose which role the new user has. This means that a user with "Publisher" access has

CVE-2026-29179 [LOW] CWE-863 CVE-2026-29179: October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, fine-grai October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, fine-grained sub-permission checks for asset and blueprint file operations were not enforced in the CMS and Tailor editor extensions. This only affects backend users who were explicitly granted editor access but had editor.cms_assets or editor.tailor_blueprints s

CVE-2026-27937 [LOW] CWE-79 CVE-2026-27937: October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflect October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping. This vulnerability is fixed in 3.7.16 and 4.1.16.

CVE-2020-5297 [LOW] CWE-73 CVE-2020-5297: In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attack In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, xml files to any directory of an October CMS server. The vulnerability is only exploitable by an authenticated