october/system vulnerabilities
System module for October CMS
- Registry
- Composer
- Latest
- 1.1.12
- License
- MIT
25 known advisories
The latest version, 1.1.12, is affected by 10 of them.
Security advisories for october/system
October CMS: PHP Object Injection via Backend Widget Session Storage
- Affected
- <3.7.17 · >=4.0.0 <4.2.23
- Fixed in
- 3.7.17, 4.2.23
October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls
- Affected
- <3.7.17 · >=4.0.0 <4.2.23
- Fixed in
- 3.7.17, 4.2.23
October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations
- Affected
- >=4.0.0 <4.1.16 · <3.7.16
- Fixed in
- 3.7.16, 4.1.16
October CMS: Reflected XSS via DataTable Form Widget
- Affected
- <3.7.16 · >=4.0.0
- Fixed in
- 3.7.16
October CMS has Safe Mode Bypass via CSS Preprocessor Compilers
- Affected
- <3.7.14 · >=4.0.0 <4.1.10
- Fixed in
- 3.7.14, 4.1.10
October CMS has Stored XSS in Event Log Mail Preview
- Affected
- >=4.0.0 <4.1.10 · <3.7.14
- Fixed in
- 3.7.14, 4.1.10
October CMS has Stored XSS in Backend Editor Markup Classes
- Affected
- >=4.0.0 <4.1.10 · <3.7.14
- Fixed in
- 3.7.14, 4.1.10
October CMS Vulnerable to Stored XSS via Branding Styles
- Affected
- <3.7.13 · >=4.0.0 <4.0.12
- Fixed in
- 3.7.13, 4.0.12
October CMS Vulnerable to Stored XSS via Editor and Branding Styles
- Affected
- <3.7.13 · >=4.0.0 <4.0.12
- Fixed in
- 3.7.13, 4.0.12
October CMS Allows Unprotected SVG Rename in Media Manager
- Affected
- <3.7.5
- Fixed in
- 3.7.5
October System module has an Open Redirect for Administrator Accounts
- Affected
- >=3.2 <3.5.15
- Fixed in
- 3.5.15
October System module has a Reflected XSS via X-October-Request-Handler Header
- Affected
- >=3.2 <3.5.15
- Fixed in
- 3.5.15
October CMS stored XSS by authenticated backend user with improper configuration
- Affected
- >=3.0.0 <3.5.2
- Fixed in
- 3.5.2
October CMS safe mode bypass using Twig sandbox escape
- Affected
- >=3.0.0 <3.4.15
- Fixed in
- 3.4.15
October CMS safe mode bypass using Page template injection
- Affected
- >=3.0.0 <3.4.15
- Fixed in
- 3.4.15
October CMS Safe Mode bypass leads to authenticated Remote Code Execution
- Affected
- >=2.0.0 <2.2.34 · >=3.0.0 <3.0.66
- Fixed in
- 2.2.34, 3.0.66
October CMS upload process vulnerable to RCE via Race Condition
- Affected
- <1.0.476 · >=1.1.0 <1.1.12 · >=2.0.0 <2.2.15
- Fixed in
- 1.0.476, 1.1.12, 2.2.15
Missing server signature validation in OctoberCMS
- Affected
- >=1.1.0 <1.1.11 · <1.0.475
- Fixed in
- 1.0.475, 1.1.11
Authenticated remote code execution in October CMS
- Affected
- <1.0.474 · >=1.1.0 <1.1.10 · >=2.0.0 <2.1.27
- Fixed in
- 1.0.474, 1.1.10, 2.1.27
october/system arbitrary code execution
- Affected
- >=1.1.0 <1.1.6 · <1.0.473
- Fixed in
- 1.0.473, 1.1.6
October/System authenticated file write leads to remote code execution
- Affected
- >=1.1.0 <1.1.6 · <1.0.473
- Fixed in
- 1.0.473, 1.1.6
Deleted Admin Can Sign In to Admin Interface
- Affected
- >=2.1.0 <2.1.12
- Fixed in
- 2.1.12
October CMS auth bypass and account takeover
- Affected
- <1.0.472 · >=1.1.1 <1.1.5
- Fixed in
- 1.0.472, 1.1.5
Account Takeover in Octobercms
- Affected
- <1.0.472 · >=1.1.1 <1.1.5
- Fixed in
- 1.0.472, 1.1.5
Use of insecure jQuery version in OctoberCMS
- Affected
- >=1.0.319 <1.0.466
- Fixed in
- 1.0.466
Which of your client projects still run an old october/system?
NPMscan reads the composer.lock in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other Composer packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the Composer registry.