UpHeron
All vulnerabilities

Servers and applications

CVE-2020-5295

Local File Inclusion by authenticated backend user with cms.manage_assets permission

Severity
Medium 4.9
Published
2 Jun 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.0.466
Also known as
GHSA-r23f-c2j5-rx2f
Sources
NVD, Project advisories (GitHub)

Description

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).

Affected software

SoftwareAffected versions
October CMSServers and applications · cpe:a:octobercms:october
  • From 1.0.319 before 1.0.466
October CMSServers and applications · github:octobercms/october
  • From 1.0.319 before 1.0.466

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-5295
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-5295
  • GitHub Advisory Database https://github.com/advisories/GHSA-r23f-c2j5-rx2f
  • github.com https://github.com/octobercms/october/security/advisories/GHSA-r23f-c2j5-rx2f