HIGH7.2

GHSA-q263-j3q9-g964

October CMS PHP Code Execution

Details

October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/october/cms

Introduced in: 0

No fixed version published yet for october/cms (composer). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2017-1000119[ADVISORY]
https://github.com/octobercms/october[PACKAGE]
http://octobercms.com/support/article/rn-8[WEB]
http://packetstormsecurity.com/files/154390/October-CMS-Upload-Protection-Bypass-Code-Execution.html[WEB]