UpHeron
All vulnerabilities

Servers and applications

CVE-2020-5297

Arbitrary Upload of Whitelisted File Types by authenticated backend user with cms.manage_assets permission

Severity
Low 2.7
Published
2 Jun 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.0.466
Also known as
GHSA-9722-rr68-rfpg
Sources
NVD, Project advisories (GitHub)

Description

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, xml files to any directory of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets`…

Affected software

SoftwareAffected versions
October CMSServers and applications · cpe:a:octobercms:october
  • From 1.0.319 before 1.0.466
October CMSServers and applications · github:octobercms/october
  • From 1.0.319 before 1.0.466

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-5297
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-5297
  • GitHub Advisory Database https://github.com/advisories/GHSA-9722-rr68-rfpg
  • github.com https://github.com/octobercms/october/security/advisories/GHSA-9722-rr68-rfpg