Read the docs
TI-2021-12318 Aliases CVE-2021-32650GHSA-5hfj-r725-wpc4

Arbitrary code execution in october/system

Priority HIGH 73CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with access to the backend is able to execute PHP code by using the theme import feature. This will bypass the safe mode feature that prevents PHP execution in the CMS templates.The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02156 82nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed october (octobercms): 1.0.473, 1.1.6october/system (Packagist): 1.1.6, 1.0.473

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
October CMSoctoberbefore 1.0.473; 1.1.0 to before 1.1.61.0.473, 1.1.6Patch availableCNA
—october/system (Packagist)1.1.0 to before 1.1.61.1.6Patch availableGHSA-5hfj-r725-wpc4
—october/system (Packagist)before 1.0.4731.0.473Patch availableGHSA-5hfj-r725-wpc4
  • october VendorOctober CMS Affected before 1.0.473; 1.1.0 to before 1.1.6 Fixed in 1.0.473, 1.1.6 Patch available CNA
  • october/system (Packagist) Vendor— Affected 1.1.0 to before 1.1.6 Fixed in 1.1.6 Patch available GHSA-5hfj-r725-wpc4
  • october/system (Packagist) Vendor— Affected before 1.0.473 Fixed in 1.0.473 Patch available GHSA-5hfj-r725-wpc4

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:octobercms:october:1.0.472:*:*:*:*:*:*:*1.0.472VulnerableOctober CMS
cpe:2.3:a:octobercms:october:1.1.5:*:*:*:*:*:*:*1.1.5VulnerableOctober CMS
  • cpe:2.3:a:octobercms:october:1.0.472:*:*:*:*:*:*:* Versions 1.0.472 Vulnerable ·October CMS
  • cpe:2.3:a:octobercms:october:1.1.5:*:*:*:*:*:*:* Versions 1.1.5 Vulnerable ·October CMS

Remediation

  • Fix · CNA october (octobercms) Fixed in 1.0.473, 1.1.6
  • Fix · GHSA-5hfj-r725-wpc4 october/system (Packagist) Fixed in 1.1.6 Advisory →
  • Fix · GHSA-5hfj-r725-wpc4 october/system (Packagist) Fixed in 1.0.473 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32650
  2. 2026-10-03 Alias added: GHSA-5hfj-r725-wpc4

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2021-12316 Account Takeover in Octobercms KEVCVSS 3.1CRITICAL 9.1
  • TI-2017-14456 October CMS build 412 is vulnerable to PHP code execution in the file upload… CVSS 3.0HIGH 7.2
  • TI-2023-23545 A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an… CVSS 3.1MEDIUM 5.4
  • TI-2023-19223 An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute… CVSS 3.1MEDIUM 5.4
  • TI-2024-30847 October 3.6.30 allows an authenticated admin account to upload a PDF file containing… CVSS 3.1MEDIUM 4.7
  • TI-2021-02315 An issue was discovered in October through build 471. CVSS 3.1CRITICAL 9.8
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences