CVE-2017-1000119
HighSummary
October CMS version 412 is vulnerable to PHP code execution in the file upload functionality, potentially leading to site compromise and possibly affecting other applications on the server.
Risk Assessment
The risk to the organization includes the potential for control over the site and other applications running on the same server.
Recommendation
It is recommended to update October CMS to the latest version to mitigate this vulnerability and implement additional security measures in the file upload functionality.
Other vulnerabilities in October CMS
See all- CVE-2017-16941High
October CMS through 1.0.428 does not prevent the use of .htaccess in themes, allowing remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a .htaccess file.
- CVE-2017-1000195High
October CMS version 412 is vulnerable to PHP object injection in asset move functionality, allowing for the deletion of files limited by file permissions on the server.
- CVE-2017-1000197Critical
October CMS version 412 is vulnerable to file path modification in asset move functionality, potentially allowing the creation of malicious files on the server.
- CVE-2017-1000196Critical
October CMS version 412 is vulnerable to PHP code execution in the asset manager functionality, potentially leading to site compromise and possibly affecting other applications on the server.
- CVE-2017-1000194Critical
October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality, potentially leading to site compromise and affecting other applications on the server.
- CVE-2026-25133Medium
October CMS versions prior to 3.7.14 and 4.1.10 contain a stored cross-site scripting vulnerability in the SVG sanitization logic. The regex pattern used to strip event handler attributes could be bypassed using a crafted payload, allowing malicious SVG files to be uploaded through the Media Manager with embedded JavaScript. Exploitation could lead to privilege escalation if a superuser views or embeds the malicious SVG, and requires authenticated backend access with media upload permissions.
- CVE-2026-25125Medium
October CMS before versions 3.7.14 and 4.1.10 contains a server-side information disclosure vulnerability in the INI settings parser. PHP's parse_ini_string() supports ${} syntax for environment variable interpolation, allowing attackers with Editor access to inject patterns like ${APP_KEY}, leading to exposure of sensitive environment variables.
- CVE-2023-37692Medium
Version 3.4.4 of October CMS contains a vulnerability that allows arbitrary file uploads, enabling attackers to execute arbitrary code via a crafted file.
Original NVD description (English source)
October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server.