CVE-2020-5297

In OctoberCMS october/october composer package versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, xml files to any directory of an October CMS server...

CVE-2020-5297 Upload whitelisted files to any directory in OctoberCMS

In OctoberCMS october/october composer package versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, xml files to any directory of an October CMS server...

CVE-2020-5297

The CVE-2020-5297 issue affects OctoberCMS (october/october composer package) versions 1.0.319–1.0.465, where an authenticated backend user with cms.manage_assets can upload many file types (images, CSS/JS, fonts, JSON, etc.) to any directory on the server. The root cause is an unrestricted file ...