Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
24 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The backend SessionMaker trait stored widget session state as base64(serialize(...)) and consumed it with unserialize() without an allowedclasses restriction. Any code path that could write to a widget. session key with attacker-controlled bytes could trigger PHP object injection the next time the widget read its session state, allowing instantiation of arbitrary classes and reachable PHP gadget chains. This issue only affects installations running with cms.safemode enabled. Safe Mode is a niche opt-in feature, primarily used for demo installations and multi-tenant or shared-editor scenarios where untrusted users are deliberately granted access to the CMS markup editor. In standard production deployments Safe Mode is off, backend access is restricted to trusted administrators, and a markup editor can already execute arbitrary PHP directly. The session-write path that reaches this sink is gated by the Safe Mode sandbox, so installations without Safe Mode enabled are not exposed. Scope…
Recommended action: Upgrade to 4.2.23 or 3.7.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability was identified in the Twig sandbox security policy that allowed a chained bypass when cms.safemode is enabled. The Laravel session store was exposed to Twig with unrestricted method access, and raw SQL methods reachable through Eloquent's call forwarding were not blocked across the full builder chain. When combined, a backend user with CMS markup editing access could read arbitrary database values via raw SQL expressions and write to the backend authentication session key, forging a backend session as another existing user. Scope of impact is narrow. Safe Mode is a niche feature, primarily used for demo installations and multi-tenant or shared-editor scenarios where untrusted users are deliberately granted access to the CMS markup editor. Standard production deployments do not enable Safe Mode, because under normal October CMS guidance backend access - including markup editing - is restricted to trusted administrators, and direct PHP injection through markup is…
Recommended action: Upgrade to 4.2.23 or 3.7.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Fine-grained sub-permission checks for asset and blueprint file operations were not enforced in the CMS and Tailor editor extensions. This only affects backend users who were explicitly granted editor access but had editor.cmsassets or editor.tailorblueprints specifically withheld, an uncommon permission configuration. In this edge case, such users could perform file operations (create, delete, rename, move, upload) on theme assets or blueprint files despite lacking the required sub-permission. A related operator precedence error in the Tailor navigation also disclosed the theme blueprint directory tree under the same conditions. Impact - Only exploitable by authenticated backend users with editor access who have been specifically denied the editor.cmsassets or editor.tailorblueprints sub-permissions - Does not affect default permission configurations where editor users typically have all sub-permissions granted - Users without editor.cmsassets could manipulate theme asset files…
Recommended action: Upgrade to 4.1.16 or 3.7.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft .less, .sass, or .scss files that leverage the compiler's import functionality to read arbitrary files from the server. This worked even with cms.safemode enabled. Impact - Potential exposure of sensitive server-side files - Requires authenticated backend access with Editor permissions - Only relevant when cms.safemode is enabled (otherwise direct PHP injection is already possible) Patches The vulnerability has been patched in v3.7.14 and v4.1.10. When cms.safemode is enabled, .less, .sass, and .scss files can no longer be created, uploaded, or edited across the CMS editor, media manager, and file upload interfaces. All users are encouraged to upgrade to the latest patched version. Workarounds If upgrading immediately is not possible: - Set cms.editableassettypes config to ['css', 'js'] to remove preprocessor file types from…
Recommended action: Upgrade to 4.1.10 or 3.7.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored cross-site scripting (XSS) vulnerability was identified in the Event Log mail preview feature. When viewing logged mail messages, HTML content was rendered in an iframe without proper sandboxing, allowing JavaScript execution in the viewer's browser context. Impact - Stored XSS via mail template content rendered in Event Log - Could allow privilege escalation if a superuser views a malicious log entry - Requires authenticated backend access with mail template editing permissions - Requires a superuser to view the specific Event Log entry to trigger Patches The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version. Workarounds If upgrading immediately is not possible: - Restrict mail template editing permissions to fully trusted administrators only - Restrict Event Log viewing permissions to minimize exposure References - Reported by Chris Alupului
Recommended action: Upgrade to 4.1.10 or 3.7.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored cross-site scripting (XSS) vulnerability was identified in the Backend Editor Settings. The Markup Classes fields (used for paragraph styles, inline styles, table styles, etc.) did not sanitize input to valid CSS class name characters. Malicious values were rendered unsanitized in Froala editor dropdown menus, allowing JavaScript execution when any user opened a RichEditor. Impact - Stored XSS via editor settings rendered in RichEditor dropdowns - Could allow privilege escalation if a superuser opens any RichEditor (e.g., editing a blog post) - Requires authenticated backend access with editor settings permissions - Triggers on routine content editing operations Patches The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version. Workarounds If upgrading immediately is not possible: - Restrict editor settings permissions to fully trusted administrators only References - Reported by Chris Alupului
Recommended action: Upgrade to 4.1.10 or 3.7.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A cross-site scripting (XSS) vulnerabilities was identified in October CMS backend configuration forms: - Branding and Appearances Styles A user with the Customize Backend Styles permission could inject malicious HTML/JS into the stylesheet input at Settings → Branding & Appearance → Styles. A specially crafted input could break out of the intended <style context, allowing arbitrary script execution across backend pages for all users. --- Impact - Persistent XSS across the backend interface. - Exploitable by lower-privileged accounts with the above permissions. - Potential consequences include privilege escalation, session hijacking, and execution of unauthorized actions in victim sessions. --- Patches The vulnerability has been patched in v4.0.12 and v3.7.13. Stylesheet inputs are now sanitized to prevent injection of arbitrary HTML/JS. All users are strongly encouraged to upgrade to the latest patched version. --- Workarounds If upgrading immediately is not possible: - Restrict the…
Recommended action: Upgrade to 4.0.12 or 3.7.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A cross-site scripting (XSS) vulnerabilities was identified in October CMS backend configuration forms: - Editor Settings Markup Styles A user with the Global Editor Settings permission could inject malicious HTML/JS into the stylesheet input at Settings → Editor Settings → Markup Styles. A specially crafted input could break out of the intended <style context, allowing arbitrary script execution across backend pages for all users. --- Impact - Persistent XSS across the backend interface. - Exploitable by lower-privileged accounts with the above permissions. - Potential consequences include privilege escalation, session hijacking, and execution of unauthorized actions in victim sessions. --- Patches The vulnerability has been patched in v4.0.12 and v3.7.13. Stylesheet inputs are now sanitized to prevent injection of arbitrary HTML/JS. All users are strongly encouraged to upgrade to the latest patched version. --- Workarounds If upgrading immediately is not possible: - Restrict the…
Recommended action: Upgrade to 4.0.12 or 3.7.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This advisory affects authenticated administrators with sites that have the media.cleanvectors configuration enabled. This configuration will sanitize SVG files uploaded using the media manager. This vulnerability allows an authenticated user to bypass this protection by uploading it with a permitted extension (for example, .jpg or .png) and later modifying it to the .svg extension. This vulnerability assumes a trusted user will attack another trusted user and cannot be actively exploited without access to the administration panel and interaction from the other user. Patches This issue has been patched in v3.7.5. References Credits to: - Cyber-Wo0dy For more information If you have any questions or comments about this advisory: Email us at hello@octobercms.com
Recommended action: Upgrade to 3.7.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This advisory affects authenticated administrators who may be redirected to an untrusted URL using the PageFinder schema. The resolver for the page finder link schema (october://) allowed external links, therefore allowing an open redirect outside the scope of the active host. This vulnerability assumes a trusted user will attack another trusted user and cannot be actively exploited without access to the administration panel and interaction from the other user. Patches This issue has been patched in v3.5.15. References Credits to: - Benzetaa For more information If you have any questions or comments about this advisory: Email us at hello@octobercms.com
Recommended action: Upgrade to 3.5.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The X-October-Request-Handler Header does not sanitize the AJAX handler name and allows unescaped HTML to be reflected back. There is no impact since this vulnerability cannot be exploited through normal browser interactions. This unescaped value is only detectable when using a proxy interception tool. Patches This issue has been patched in v3.5.15. References Credits to: - Mayank Mehra For more information If you have any questions or comments about this advisory: Email us at hello@octobercms.com
Recommended action: Upgrade to 3.5.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. SVG files are supported by default in v3 for convenience; however, this has resulted in multiple mistaken vulnerability reports from security researchers. As per the documentation, if a backend user is not trusted, the advice is to remove the svg extension from the list of supported file types. Patches The issue has been patched in v3.5.2 by including an SVG sanister. It is enabled by default for new installations but must be enabled for existing sites in the config/media.php file. Workarounds If you cannot upgrade for this patch, follow the pervious advice and remove svg from the supported file types. References - https://github.com/octobercms/october/blob/3.x/config/media.php Credits to: - Faris Krivic - Okan Kurtulus - Aldin Visnjic - Bug Shankar For more information If you have…
Recommended action: Upgrade to 3.5.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An authenticated backend user with the editor.cmspages, editor.cmslayouts, or editor.cmspartials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to cms.safemode being enabled can write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This is not a problem for anyone who trusts their users with those permissions to usually write and manage PHP within the CMS by not having cms.safemode enabled. Still, it would be a problem for anyone relying on cms.safemode to ensure that users with those permissions in production do not have access to write and execute arbitrary PHP. Patches This issue has been patched in v3.4.15. Workarounds As a workaround, remove the specified permissions from untrusted users. References Credits to: - Vasiliy Bodrov For more information If you have any questions or comments about this advisory: Email us at hello@octobercms.com
Recommended action: Upgrade to 3.4.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An authenticated backend user with the editor.cmspages, editor.cmslayouts, or editor.cmspartials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to cms.safemode being enabled can craft a special request to include PHP code in the CMS template. This is not a problem for anyone who trusts their users with those permissions to usually write & manage PHP within the CMS by not having cms.safemode enabled. Still, it would be a problem for anyone relying on cms.safemode to ensure that users with those permissions in production do not have access to write and execute arbitrary PHP. Patches This issue has been patched in v3.4.15. Workarounds As a workaround, remove the specified permissions from untrusted users. References Credits to: - Vasiliy Bodrov For more information If you have any questions or comments about this advisory: Email us at hello@octobercms.com
Recommended action: Upgrade to 3.4.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin panel and permission to open the "Editor" section, they can bypass the Safe Mode (cms.safemode) restriction to introduce new PHP code in a CMS template using a specially crafted request. Patches The issue has been patched in v2.2.34 and v3.0.66 References Credits to: - David Miller For more information If you have any questions or comments about this advisory: - Email us at hello@octobercms.com
Recommended action: Upgrade to 3.0.66 or 2.2.34 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This advisory affects plugins that expose the October\Rain\Database\Attach\File::fromData as a public interface. This vulnerability does not affect vanilla installations of October CMS since this method is not exposed or used by the system internally or externally. When the developer allows the user to specify their own filename in the fromData method, an unauthenticated user can perform remote code execution (RCE) by exploiting a race condition in the temporary storage directory. Patches The issue has been patched in Build 476 (v1.0.476) and v1.1.12 and v2.2.15. Workarounds Apply https://github.com/octobercms/library/commit/fe569f3babf3f593be2b1e0a4ae0283506127a83 to your installation manually if unable to upgrade to Build 476 (v1.0.476) or v1.1.12 or v2.2.15. References Credits to: - DucNT, HungTD and GiangVQ from RedTeam@VNG Security Response Center. For more information If you have any questions or comments about this advisory: - Email us at hello@octobercms.com
Recommended action: Upgrade to 2.2.15, 1.1.12 or 1.0.476 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This advisory affects authors of plugins and themes listed on the October CMS marketplace where an end-user will inadvertently expose authors to potential financial loss by entering their private license key into a compromised server. It has been disclosed that a project fork of October CMS v1.0 is using a compromised gateway to access the October CMS marketplace service. The compromised gateway captures the personal/business information of users and authors, including private source code files. It was also disclosed that captured plugin files are freely redistributed to other users without authorization. 1. End-users are provided with a forked version of October CMS v1.0. The provided software is modified to use a compromised gateway server. 2. The user is instructed to enter their October CMS license key into the administration panel to access the October CMS marketplace. The key is sent to the compromised server while appearing to access the genuine October CMS gateway…
Recommended action: Upgrade to 1.1.11 or 1.0.475 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass cms.safemode / cms.enableSafeMode in order to execute arbitrary code. - This issue only affects admin panels that rely on safe mode and restricted permissions. - To exploit this vulnerability, an attacker must first have access to the backend area. Patches The issue has been patched in Build 474 (v1.0.474) and v1.1.10. Workarounds Apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually if unable to upgrade to Build 474 or v1.1.10. References Credits to: - David Miller For more information If you have any questions or comments about this advisory: - Email us at hello@octobercms.com
Recommended action: Upgrade to 2.1.27, 1.1.10 or 1.0.474 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Assuming an attacker with access to the backend is able to execute PHP code by using the theme import feature. This will bypass the safe mode feature that prevents PHP execution in the CMS templates. Patches Issue has been patched in Build 473 and v1.1.6 Workarounds Apply https://github.com/octobercms/october/commit/167b592eed291ae1563c8fcc5b9b34a03a300f26 to your installation manually if you are unable to upgrade. References Credits to: • Sushi Yushi For more information If you have any questions or comments about this advisory: Email us at hello@octobercms.com
Recommended action: Upgrade to 1.1.6 or 1.0.473 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Assuming an attacker with "create, modify and delete website pages" privileges in the backend is able to execute PHP code by running specially crafted Twig code in the template markup. Patches Issue has been patched in Build 473 and v1.1.6 Workarounds Apply https://github.com/octobercms/october/commit/167b592eed291ae1563c8fcc5b9b34a03a300f26 to your installation manually if you are unable to upgrade. References Credits to: • David Miller For more information If you have any questions or comments about this advisory: Email us at hello@octobercms.com
Recommended action: Upgrade to 1.1.6 or 1.0.473 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Assuming an administrator once had previous access to the admin interface, they may still be able to sign in to the backend using October CMS v2.0. Patches The issue has been patched in v2.1.12 Workarounds - Reset the password of the deleted accounts to prevent them from signing in. - Please contact hello@octobercms.com for code change instructions if you are unable to upgrade. References Credits to: • Daniel Bidala For more information If you have any questions or comments about this advisory: Email us at hello@octobercms.com
Recommended action: Upgrade to 2.1.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker can exploit this vulnerability to bypass authentication using a specially crafted persist cookie. - To exploit this vulnerability, an attacker must obtain a Laravel’s secret key for cookie encryption and signing. - Due to the logic of how this mechanism works, a targeted user account must be logged in while the attacker is exploiting the vulnerability. - Authorization via persist cookie not shown in access logs. Patches - Issue has been patched in Build 472 and v1.1.5 - Shortened patch instructions Workarounds Apply https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374 and https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9 to your installation manually if you are unable to upgrade. [Update 2022-01-20] Shortened patch instructions can be found here. Recommendations We recommend the following steps to make sure your server stays secure: - Keep server OS and system software up to date. - Keep October…
Recommended action: Upgrade to 1.1.5 or 1.0.472 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker can request an account password reset and then gain access to the account using a specially crafted request. - To exploit this vulnerability, an attacker must know the username of an administrator and have access to the password reset form. Patches - Issue has been patched in Build 472 and v1.1.5 - Shortened patch instructions Workarounds Apply https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374 and https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9 to your installation manually if you are unable to upgrade. [Update 2022-01-20] Shortened patch instructions can be found here. Recommendations We recommend the following steps to make sure your server stays secure: - Keep server OS and system software up to date. - Keep October CMS software up to date. - Use a multi-factor authentication plugin. - Change the default backend URL or block public access to the backend area. - Include the…
Recommended action: Upgrade to 1.1.5 or 1.0.472 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. Patches Issue has been patched in Build 466 (v1.0.466) by applying the recommended patch from @jquery. Workarounds Apply https://github.com/octobercms/october/commit/5c7ba9fbe9f2b596b2f0e3436ee06b91b97e5892 to your installation manually if unable to upgrade to Build 466. References - https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022 - https://jquery.com/upgrade-guide/3.5/ For more information If you have any questions or comments about this advisory: Email us at octobercms@luketowers.ca & hello@octobercms.com Threat Assessment Assessed as Moderate by the @jquery team. Acknowledgements Thanks to @mrgswift for reporting the issue to the October CMS team.
Recommended action: Upgrade to 1.0.466 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.