VULNERABILITY INTELLIGENCE

CVE-2021-32650

CVSS score8.8 HIGH

EPSS probability2.09%

CISA KEVNot currently listed

Published2022-01-14

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with access to the backend is able to execute PHP code by using the theme import feature. This will bypass the safe mode feature that prevents PHP execution in the CMS templates.The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround.

Weakness classification

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references

security-advisories@github.com — Patch, Third Party Advisory
security-advisories@github.com — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory