Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries. Impact - Stored XSS via malicious SVG files uploaded through the Media Manager - Could allow privilege escalation if a superuser views or embeds the malicious SVG - Requires authenticated backend access with media upload permissions (media.library.create) - SVG must be viewed or embedded in a page to trigger Patches The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version. Workarounds If upgrading immediately is not possible: - Disable SVG uploads by adding svg to the blocked extensions in media configuration - Set media.cleanvectors to true in configuration (enabled by default) References - Reported by Pentest-Tools.com
Recommended action: Upgrade to 4.1.10 or 3.7.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parseinistring() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APPKEY}, ${DBPASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened. Impact - Exfiltration of sensitive environment variables (APPKEY, DB credentials, AWS keys, etc.) - Could enable further attacks: database access, cookie forgery, AWS resource access - Requires authenticated backend access with Editor permissions - Only relevant when cms.safemode is enabled (otherwise direct PHP injection is already possible) Patches The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version. Workarounds If upgrading immediately is not possible: -…
Recommended action: Upgrade to 4.1.10 or 3.7.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMSSAFEMODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections. Impact - Bypass of Twig sandbox restrictions - Only affects installations with CMSSAFEMODE enabled (disabled by default) - Requires authenticated backend access with CMS template editing permissions Patches The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version. Workarounds If upgrading immediately is not possible: - Disable CMSSAFEMODE if untrusted template editing is not required - Restrict CMS template editing permissions to fully trusted administrators only References - Reported by Łukasz Rybak
Recommended action: Upgrade to 4.1.5 or 3.7.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context of the Admin account.
Recommended action: Upgrade to 1.0.426 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When logging out, the session ID was not invalidated. This is not a problem while the user is logged out, but as soon as the user logs back in the old session ID would be valid again; which means that anyone that gained access to the old session cookie would be able to act as the logged in user. This is not a major concern for the majority of cases, since it requires a malicious party gaining access to the session cookie in the first place, but nevertheless has been fixed. Patches Issue has been patched in Build 472 (v1.0.472) and v1.1.2. Workarounds Apply https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024 to your installation manually if unable to upgrade to Build 472 or v1.1.2. References - Reported by Anisio (Brazilian Information Security Analyst) - http://cve.circl.lu/cve/CVE-2021-3311 For more information If you have any questions or comments about this advisory: Email us at hello@octobercms.com Threat assessment: <img width="699"…
Recommended action: Upgrade to 1.1.2 or 1.0.472 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Previously encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code (nothing exploitable in the core project itself) had a higher chance of succeeding. Specifically, if your usage exposed a way for users to provide unfiltered user input and have it returned to them as an encrypted cookie (ex. storing a user provided search query in a cookie) they could then use the generated cookie in place of other more tightly controlled cookies; or if your usage exposed the plaintext version of an encrypted cookie at any point to the user they could theoretically provide encrypted content from your application back to it as an encrypted cookie and force the framework to decrypt it for them. Patches Issue has been patched in Build 468 (v1.0.468). NOTE: If you are using the cookie session driver, all of your session data will be invalidated. All…
Recommended action: Upgrade to 1.0.468 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.