# october/system (Packagist) vulnerabilities 24 known vulnerabilities (1 critical, 7 high, 9 medium, 7 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/october/system ## Advisories (24) ### [CVE-2026-49400](https://cve.now/CVE-2026-49400): October CMS: PHP Object Injection via Backend Widget Session Storage - Severity: Low 3.3 - Published: Sep 14, 2026 - Affected: fixed in 3.7.17; from 4.0.0, fixed in 4.2.23. ### [CVE-2026-46696](https://cve.now/CVE-2026-46696): October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls - Severity: Low 3.3 - Published: Sep 14, 2026 - Affected: fixed in 3.7.17; from 4.0.0, fixed in 4.2.23. ### [CVE-2026-29179](https://cve.now/CVE-2026-29179): October: Editor Sub-Permission Bypass for Asset and Blueprint File Operations - Severity: Low 3.3 - Published: Apr 21, 2026 - Affected: from 4.0.0, fixed in 4.1.16; fixed in 3.7.16. ### [CVE-2026-27937](https://cve.now/CVE-2026-27937): October: Reflected XSS via DataTable Form Widget - Severity: Low 3.1 - Published: Apr 21, 2026 - Affected: fixed in 3.7.16; from 4.0.0. ### [CVE-2026-26067](https://cve.now/CVE-2026-26067): October: Safe Mode Bypass via CSS Preprocessor Compilers - Severity: Medium 4.9 - Published: Apr 21, 2026 - Affected: fixed in 3.7.14; from 4.0.0, fixed in 4.1.10. ### [CVE-2026-24907](https://cve.now/CVE-2026-24907): October CMS has Stored XSS via Event Log Mail Preview - Severity: Medium 5.1 - Published: Apr 14, 2026 - Affected: from 4.0.0, fixed in 4.1.10; fixed in 3.7.14. ### [CVE-2026-24906](https://cve.now/CVE-2026-24906): October CMS has Stored XSS in its Backend Editor Markup Classes - Severity: Medium 5.1 - Published: Apr 14, 2026 - Affected: from 4.0.0, fixed in 4.1.10; fixed in 3.7.14. ### [CVE-2025-61674](https://cve.now/CVE-2025-61674): October CMS Vulnerable to Stored XSS via Editor and Branding Styles - Severity: Medium 6.1 - Published: Jan 10, 2026 - Affected: fixed in 3.7.13; from 4.0.0, fixed in 4.0.12. ### [CVE-2025-61676](https://cve.now/CVE-2025-61676): October CMS Vulnerable to Stored XSS via Branding Styles - Severity: Medium 6.1 - Published: Jan 10, 2026 - Affected: fixed in 3.7.13; from 4.0.0, fixed in 4.0.12. ### [CVE-2024-51991](https://cve.now/CVE-2024-51991): October CMS Allows Unprotected SVG Rename in Media Manager - Severity: Low 1.1 - Published: May 5, 2025 - Affected: fixed in 3.7.5. ### [CVE-2024-25637](https://cve.now/CVE-2024-25637): Reflected XSS via X-October-Request-Handler Header - Severity: Low 3.1 - Published: Jun 26, 2024 - Affected: from 3.2, fixed in 3.5.15. ### [CVE-2024-24764](https://cve.now/CVE-2024-24764): October Open Redirect for Administrator Accounts - Severity: Low 3.5 - Published: Jun 26, 2024 - Affected: from 3.2, fixed in 3.5.15. ### [CVE-2023-44381](https://cve.now/CVE-2023-44381): October CMS safe mode bypass using Page template injection - Severity: Medium 4.9 - Published: Dec 1, 2023 - Affected: from 3.0.0, fixed in 3.4.15. ### [CVE-2023-44382](https://cve.now/CVE-2023-44382): October CMS safe mode bypass using Twig sandbox escape - Severity: Critical 9.1 - Published: Dec 1, 2023 - Affected: from 3.0.0, fixed in 3.4.15. ### [CVE-2023-44383](https://cve.now/CVE-2023-44383): October CMS stored XSS by authenticated backend user with improper configuration - Severity: Medium 5.4 - Published: Nov 29, 2023 - Affected: from 3.0.0, fixed in 3.5.2. ### [CVE-2022-35944](https://cve.now/CVE-2022-35944): October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution) - Severity: Medium 6.2 - Published: Oct 13, 2022 - Affected: from 2.0.0, fixed in 2.2.34; from 3.0.0, fixed in 3.0.66. ### [CVE-2022-24800](https://cve.now/CVE-2022-24800): Race Condition in October CMS upload process - Severity: High 8.1 - Published: Jul 12, 2022 - Affected: fixed in 1.0.476; from 1.1.0, fixed in 1.1.12; from 2.0.0, fixed in 2.2.15. ### [CVE-2022-23655](https://cve.now/CVE-2022-23655): Missing server signature validation in OctoberCMS - Severity: Medium 4.8 - Published: Feb 23, 2022 - Affected: from 1.1.0, fixed in 1.1.11; fixed in 1.0.475. ### [CVE-2022-21705](https://cve.now/CVE-2022-21705): Authenticated remote code execution in octobercms - Severity: High 7.2 - Published: Feb 23, 2022 - Affected: fixed in 1.0.474; from 1.1.0, fixed in 1.1.10; from 2.0.0, fixed in 2.1.27. ### [CVE-2021-32649](https://cve.now/CVE-2021-32649): Authenticated file write leads to remote code execution in october/system - Severity: High 8.8 - Published: Jan 14, 2022 - Affected: from 1.1.0, fixed in 1.1.6; fixed in 1.0.473. ### [CVE-2021-32650](https://cve.now/CVE-2021-32650): Arbitrary code execution in october/system - Severity: High 8.8 - Published: Jan 14, 2022 - Affected: from 1.1.0, fixed in 1.1.6; fixed in 1.0.473. ### [CVE-2021-41126](https://cve.now/CVE-2021-41126): Deleted Admin Can Sign In to Admin Interface - Severity: High 7.2 - Published: Oct 6, 2021 - Affected: from 2.1.0, fixed in 2.1.12. ### [CVE-2021-29487](https://cve.now/CVE-2021-29487): Authentication bypass in Octobercms - Severity: High 7.4 - Published: Aug 26, 2021 - Affected: fixed in 1.0.472; from 1.1.1, fixed in 1.1.5. ### [CVE-2021-32648](https://cve.now/CVE-2021-32648): Account Takeover in Octobercms - Severity: High 8.2 ยท KEV - Published: Aug 26, 2021 - Affected: fixed in 1.0.472; from 1.1.1, fixed in 1.1.5. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/october/system Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.