Read the docs
TI-2022-08613 Aliases CVE-2022-24800GHSA-8v7h-cpc2-r8jp

Race Condition in October CMS upload process

Priority MEDIUM 40CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.476, 1.1.12, and 2.2.15, when the developer allows the user to specify their own filename in the `fromData` method, an unauthenticated user can perform remote code execution (RCE) by exploiting a race condition in the temporary storage directory. This vulnerability affects plugins that expose the `October\Rain\Database\Attach\File::fromData` as a public interface and does not affect vanilla installations of October CMS since this method is not exposed or used by the system internally or externally. The issue has been patched in Build 476 (v1.0.476), v1.1.12, and v2.2.15. Those who are unable to upgrade may apply with patch to their installation manually as a workaround.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01462 73rd percentileScored 2026-11-07
Fix Fixed october (octobercms): 1.0.476, 1.1.12, 2.2.15october/system (Packagist): 1.0.476, 1.1.12, 2.2.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
October CMSoctoberbefore 1.0.476; 1.1.0 to before 1.1.12; 2.0.0 to before 2.2.151.0.476, 1.1.12, 2.2.15Patch availableCNA
—october/system (Packagist)before 1.0.4761.0.476Patch availableGHSA-8v7h-cpc2-r8jp
—october/system (Packagist)1.1.0 to before 1.1.121.1.12Patch availableGHSA-8v7h-cpc2-r8jp
—october/system (Packagist)2.0.0 to before 2.2.152.2.15Patch availableGHSA-8v7h-cpc2-r8jp
  • october VendorOctober CMS Affected before 1.0.476; 1.1.0 to before 1.1.12; 2.0.0 to before 2.2.15 Fixed in 1.0.476, 1.1.12, 2.2.15 Patch available CNA
  • october/system (Packagist) Vendor— Affected before 1.0.476 Fixed in 1.0.476 Patch available GHSA-8v7h-cpc2-r8jp
  • october/system (Packagist) Vendor— Affected 1.1.0 to before 1.1.12 Fixed in 1.1.12 Patch available GHSA-8v7h-cpc2-r8jp
  • october/system (Packagist) Vendor— Affected 2.0.0 to before 2.2.15 Fixed in 2.2.15 Patch available GHSA-8v7h-cpc2-r8jp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*before 1.0.476; 1.1.0 to before 1.1.12; 2.0.0 to before 2.2.15VulnerableOctober CMS
  • cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:* Versions before 1.0.476; 1.1.0 to before 1.1.12; 2.0.0 to before 2.2.15 Vulnerable ·October CMS

Remediation

  • Fix · CNA october (octobercms) Fixed in 1.0.476, 1.1.12, 2.2.15
  • Fix · GHSA-8v7h-cpc2-r8jp october/system (Packagist) Fixed in 1.0.476 Advisory →
  • Fix · GHSA-8v7h-cpc2-r8jp october/system (Packagist) Fixed in 1.1.12 Advisory →
  • Fix · GHSA-8v7h-cpc2-r8jp october/system (Packagist) Fixed in 2.2.15 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24800
  2. 2026-10-03 Alias added: GHSA-8v7h-cpc2-r8jp

References

Patch 2

Advisory 1

Other 1

  • TI-2021-12316 Account Takeover in Octobercms KEVCVSS 3.1CRITICAL 9.1
  • TI-2021-12318 Arbitrary code execution in october/system CVSS 3.1HIGH 8.8
  • TI-2017-14456 October CMS build 412 is vulnerable to PHP code execution in the file upload… CVSS 3.0HIGH 7.2
  • TI-2023-23545 A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an… CVSS 3.1MEDIUM 5.4
  • TI-2023-19223 An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute… CVSS 3.1MEDIUM 5.4
  • TI-2024-30847 October 3.6.30 allows an authenticated admin account to upload a PDF file containing… CVSS 3.1MEDIUM 4.7
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences