UpHeron
All vulnerabilities

Servers and applications

CVE-2020-5298

Reflected XSS when importing CSV files via the ImportExportController

Severity
Medium 4.8
Published
2 Jun 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.0.466
Also known as
GHSA-gg6x-xx78-448c
Sources
NVD, Project advisories (GitHub)

Description

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the `ImportExportController` behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question Issue has been patched in Build 466 (v1.0.466).

Affected software

SoftwareAffected versions
October CMSServers and applications · cpe:a:octobercms:october
  • From 1.0.319 before 1.0.466
October CMSServers and applications · github:octobercms/october
  • From 1.0.319 before 1.0.466

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-5298
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-5298
  • GitHub Advisory Database https://github.com/advisories/GHSA-gg6x-xx78-448c
  • github.com https://github.com/octobercms/october/security/advisories/GHSA-gg6x-xx78-448c