Is october/system 1.0 vulnerable?
Composer · 158 releases from 1.0.319 to 1.0.476 · latest october/system is 1.1.12 · checked 2 Nov 2026
Yes: 10 known advisories
Yes. october/system 1.0.476, the last 1.0 release, is affected by 10 known security advisories (5 medium, 5 low), including CVE-2026-26067, CVE-2026-24907, CVE-2026-24906. 8 more affect earlier 1.0.x releases. Upgrade to 3.7.17 or later to fix all of them.
composer require october/system:^3.7.17Advisories affecting october/system 1.0.476
October CMS: PHP Object Injection via Backend Widget Session Storage
- Affected
- <3.7.17 · >=4.0.0 <4.2.23
- Fixed in
- 3.7.17, 4.2.23
October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls
- Affected
- <3.7.17 · >=4.0.0 <4.2.23
- Fixed in
- 3.7.17, 4.2.23
October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations
- Affected
- >=4.0.0 <4.1.16 · <3.7.16
- Fixed in
- 3.7.16, 4.1.16
October CMS: Reflected XSS via DataTable Form Widget
- Affected
- <3.7.16 · >=4.0.0
- Fixed in
- 3.7.16
October CMS has Safe Mode Bypass via CSS Preprocessor Compilers
- Affected
- <3.7.14 · >=4.0.0 <4.1.10
- Fixed in
- 3.7.14, 4.1.10
October CMS has Stored XSS in Event Log Mail Preview
- Affected
- >=4.0.0 <4.1.10 · <3.7.14
- Fixed in
- 3.7.14, 4.1.10
October CMS has Stored XSS in Backend Editor Markup Classes
- Affected
- >=4.0.0 <4.1.10 · <3.7.14
- Fixed in
- 3.7.14, 4.1.10
October CMS Vulnerable to Stored XSS via Branding Styles
- Affected
- <3.7.13 · >=4.0.0 <4.0.12
- Fixed in
- 3.7.13, 4.0.12
October CMS Vulnerable to Stored XSS via Editor and Branding Styles
- Affected
- <3.7.13 · >=4.0.0 <4.0.12
- Fixed in
- 3.7.13, 4.0.12
October CMS Allows Unprotected SVG Rename in Media Manager
- Affected
- <3.7.5
- Fixed in
- 3.7.5
Fixed within 1.0.x, affecting earlier releases
October CMS upload process vulnerable to RCE via Race Condition
- Affected
- <1.0.476 · >=1.1.0 <1.1.12 · >=2.0.0 <2.2.15
- Fixed in
- 1.0.476, 1.1.12, 2.2.15
Missing server signature validation in OctoberCMS
- Affected
- >=1.1.0 <1.1.11 · <1.0.475
- Fixed in
- 1.0.475, 1.1.11
Authenticated remote code execution in October CMS
- Affected
- <1.0.474 · >=1.1.0 <1.1.10 · >=2.0.0 <2.1.27
- Fixed in
- 1.0.474, 1.1.10, 2.1.27
october/system arbitrary code execution
- Affected
- >=1.1.0 <1.1.6 · <1.0.473
- Fixed in
- 1.0.473, 1.1.6
October/System authenticated file write leads to remote code execution
- Affected
- >=1.1.0 <1.1.6 · <1.0.473
- Fixed in
- 1.0.473, 1.1.6
October CMS auth bypass and account takeover
- Affected
- <1.0.472 · >=1.1.1 <1.1.5
- Fixed in
- 1.0.472, 1.1.5
Account Takeover in Octobercms
- Affected
- <1.0.472 · >=1.1.1 <1.1.5
- Fixed in
- 1.0.472, 1.1.5
Use of insecure jQuery version in OctoberCMS
- Affected
- >=1.0.319 <1.0.466
- Fixed in
- 1.0.466
Which of your client projects are still on october/system 1.0?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact october/system version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other october/system versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.