UpHeron
All vulnerabilities

Servers and applications

CVE-2020-15249

Stored XSS by authenticated backend user with access to upload files

Severity
Medium 5.4
Published
22 Nov 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.0.469
Also known as
GHSA-fx3v-553x-3c4q
Sources
NVD, Project advisories (GitHub)

Description

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, backend users with access to upload files were permitted to upload SVG files without any sanitization applied to the uploaded files. Since SVG files support being parsed as HTML by browsers, this means that they could theoretically upload…

Affected software

SoftwareAffected versions
October CMSServers and applications · cpe:a:octobercms:october
  • From 1.0.319 before 1.0.469
October CMSServers and applications · github:octobercms/october
  • From 1.0.319 before 1.0.469

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-15249
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-15249
  • GitHub Advisory Database https://github.com/advisories/GHSA-fx3v-553x-3c4q
  • github.com https://github.com/octobercms/october/security/advisories/GHSA-fx3v-553x-3c4q