Local File read vulnerability in OctoberCMS

TRUNG BÌNH 4.9CVE-2020-5295 · GHSA-r23f-c2j5-rx2f · Công bố 03/06/2020 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2020-5295 là lỗ hổng mức TRUNG BÌNH (CVSS 4.9) ảnh hưởng october/cms, october (octobercms).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 7.4%, cao hơn 94.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.0.466 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
october/cms Packagist	`≥ 1.0.319, < 1.0.466`	`1.0.466`
october octobercms	`≥ 1.0.319, < 1.0.466`	`1.0.466`

Mô tả

Impact

An attacker can exploit this vulnerability to read local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the cms.manage_assets permission.

Patches

Issue has been patched in Build 466 (v1.0.466).

Workarounds

Apply https://github.com/octobercms/october/commit/2b8939cc8b5b6fe81e093fe2c9f883ada4e3c8cc to your installation manually if unable to upgrade to Build 466.

References

Reported by Sivanesh Ashok

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

Threat assessment:

Mô tả của NVD

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).