TI-2021-12317 Aliases CVE-2021-32649 GHSA-wv23-pfj7-2mjj

Authenticated file write leads to remote code execution in october/system

MEDIUM 43CWE-74Published 2022-01-14 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with "create, modify and delete website pages" privileges in the backend is able to execute PHP code by running specially crafted Twig code in the template markup. The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0138 72nd percentileScored 2026-11-07

Fix Fixed october (octobercms): 1.0.473, 1.1.6october/system (Packagist): 1.1.6, 1.0.473

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
October CMS	october	before 1.0.473; 1.1.0 to before 1.1.6	1.0.473, 1.1.6	Patch available	CNA
—	october/system (Packagist)	1.1.0 to before 1.1.6	1.1.6	Patch available	GHSA-wv23-pfj7-2mjj
—	october/system (Packagist)	before 1.0.473	1.0.473	Patch available	GHSA-wv23-pfj7-2mjj

october VendorOctober CMS Affected before 1.0.473; 1.1.0 to before 1.1.6 Fixed in 1.0.473, 1.1.6 Patch available CNA
october/system (Packagist) Vendor— Affected 1.1.0 to before 1.1.6 Fixed in 1.1.6 Patch available GHSA-wv23-pfj7-2mjj
october/system (Packagist) Vendor— Affected before 1.0.473 Fixed in 1.0.473 Patch available GHSA-wv23-pfj7-2mjj

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:octobercms:october::::::::	before 1.0.473; 1.1.0 to before 1.1.6	Vulnerable	October CMS

cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:* Versions before 1.0.473; 1.1.0 to before 1.1.6 Vulnerable ·October CMS

Remediation

Fix · CNA october (octobercms) Fixed in 1.0.473, 1.1.6
Fix · GHSA-wv23-pfj7-2mjj october/system (Packagist) Fixed in 1.1.6 Advisory →
Fix · GHSA-wv23-pfj7-2mjj october/system (Packagist) Fixed in 1.0.473 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-32649
2026-10-03 Alias added: GHSA-wv23-pfj7-2mjj

References

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2021-32649

Other 1

https://github.com/octobercms/october

TI-2021-12316 Account Takeover in Octobercms KEVCVSS 3.1CRITICAL 9.1
TI-2021-12318 Arbitrary code execution in october/system CVSS 3.1HIGH 8.8
TI-2017-14456 October CMS build 412 is vulnerable to PHP code execution in the file upload… CVSS 3.0HIGH 7.2
TI-2023-23545 A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an… CVSS 3.1MEDIUM 5.4
TI-2023-19223 An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute… CVSS 3.1MEDIUM 5.4
TI-2024-30847 October 3.6.30 allows an authenticated admin account to upload a PDF file containing… CVSS 3.1MEDIUM 4.7

See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences