October CMS PHP Code Execution

ALTO 7.2CVE-2017-1000119 · GHSA-q263-j3q9-g964 · Published 05/10/2017 · updated 17/06/2026

Package	Affected versions	Patched versions
october/cms Packagist	`≤ 1.0.412`	No fix yet
october octobercms	`= 1.0.412`	No fix yet

Description

October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server.

NVD description

October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server.

References

nvd.nist.gov/vuln/detail/CVE-2017-1000119 · ADVISORY
octobercms/october · PACKAGE
octobercms.com/support/article/rn-8 · WEB
packetstormsecurity.com/files/154390/October-CMS-Upload-Protection-Bypass-Code-Execution.html · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free