CVE-2021-32650

2022-01-1415:15:07

Google

osv.dev

8.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

49.8%

JSON

October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with access to the backend is able to execute PHP code by using the theme import feature. This will bypass the safe mode feature that prevents PHP execution in the CMS templates.The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround.

CPENameOperatorVersion
octobereq1.0.434
octobereq1.0.364
octobereq1.0.460
octobereq1.0.377
octobereq1.0.405
octobereq1.0.399
octobereq1.0.370
octobereq1.0.404
octobereq1.0.373
octobereq1.0.338

Name	Operator	Version
october	eq	1.0.434
october	eq	1.0.364
october	eq	1.0.460
october	eq	1.0.377
october	eq	1.0.405
october	eq	1.0.399
october	eq	1.0.370
october	eq	1.0.404
october	eq	1.0.373
october	eq	1.0.338