Double free

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.470, backend users with the default "Publisher" system role have access to create & manage users where they can choose which role the new user ha...

CVE-2020-15249

CVE-2020-15249 applies to October CMS: backend file upload allowed SVGs without sanitization in versions before 1.0.469 (and 1.0.x), enabling potential stored XSS via uploaded SVG content. The issue’s root cause is lack of SVG sanitization in the Media upload feature; the backend displays SVGs as...

CVE-2020-15249 Stored XSS by authenticated backend user with access to upload files

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, backend users with access to upload files were permitted to upload SVG files without any sanitization applied to the uploaded files. Since S...

CVE-2020-15248

CVE-2020-15248 affects October CMS prior to 1.0.470 (and 1.0.470+ in 1.0 line), where backend users with the default Publisher role can create/manage users and assign roles, enabling privilege escalation to Developer. Root cause: insecure authorization in user-creation workflow allows escalation....

CVE-2020-15248 Privilege escalation by backend users assigned to the default "Publisher" system role

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.470, backend users with the default "Publisher" system role have access to create & manage users where they can choose which role the new user ha...

CVE-2020-15247 Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, an authenticated backend user with the cms.managepages, cms.managelayouts, or cms.managepartials permissions who would normally not be...

CVE-2020-15246

CVE-2020-15246 affects October CMS (Laravel-based). A Local File Inclusion (LFI) vulnerability allows reading local files on an October CMS server via a specially crafted request. Affected versions are 1.0.421 up to, but not including, 1.0.469. The issue has been patched in Build 469 (v1.0.469) a...

CVE-2020-15246 Local File Inclusion by unauthenticated users

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.421 and before version 1.0.469, an attacker can read local files on an October CMS server via a specially crafted request. Issue has been patched in Build 469 v1.0.469 and...