OctoberCMS vulnerabilities
We track 6 vulnerabilities in OctoberCMS products across 2 products. 6 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on September 28, 2026.
Latest OctoberCMS vulnerabilities
- 7.3 High severity
OctoberCMS: Server-Side Request Forgery
A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request f
- 9.1 Critical severity
october: Improper Control of Generation of Code
October is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `editor.cms_pages`, `editor.cms_layouts`, or `editor.cms_partials` permissions who would normally not be permitted to prov
- 7.2 High severity
october: Improper Control of Generation of Code
October is a self-hosted Content Management System (CMS) platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming
- 8.1 High severity
october: Concurrent Execution using Shared Resource with Improper Synchronization
October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.476, 1.1.12, and 2.2.15, when the developer allows the user to specify their own filename in the `fromData` method, an una
- 7.2 High severity
october: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vul
- 9.1 Critical severity
October CMS Improper Authentication Exploited
octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patc