CVE-2024-51991

October is a Content Management System CMS and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administrators with sites that have the media.cleanvectors configuration enabled. This configuration will sanitize SVG files uploaded using the media manager. This...

CVE-2024-51991

CVE-2024-51991 concerns October CMS (versions prior to 3.7.5) where an authenticated administrator with a site using the media.clean_vectors SVG sanitization can bypass protection by uploading a file with a permitted extension (e.g., .jpg/.png) and later renaming it to .svg. The issue is mitigate...

GHSA-96HH-8HX5-CPW7 October CMS Allows Unprotected SVG Rename in Media Manager

Impact This advisory affects authenticated administrators with sites that have the media.cleanvectors configuration enabled. This configuration will sanitize SVG files uploaded using the media manager. This vulnerability allows an authenticated user to bypass this protection by uploading it with ...