UpHeron
All vulnerabilities

Servers and applications

CVE-2020-5299

Potential CSV Injection vector

Severity
Medium 5.1
Published
2 Jun 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.0.466
Also known as
GHSA-4rhm-m2fp-hx7q
Sources
NVD, Project advisories (GitHub)

Description

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, any users with the ability to modify any data that could eventually be exported as a CSV file from the `ImportExportController` could potentially introduce a CSV injection into the data to cause the generated CSV export file to be malicious. This requires attackers to achieve the following before a…

Affected software

SoftwareAffected versions
October CMSServers and applications · cpe:a:octobercms:october
  • From 1.0.319 before 1.0.466
October CMSServers and applications · github:octobercms/october
  • From 1.0.319 before 1.0.466

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-5299
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-5299
  • GitHub Advisory Database https://github.com/advisories/GHSA-4rhm-m2fp-hx7q
  • github.com https://github.com/octobercms/october/security/advisories/GHSA-4rhm-m2fp-hx7q