UpHeron
All vulnerabilities

Servers and applications

CVE-2021-32649

Authenticated file write leads to remote code execution

Severity
High 8.8
Published
14 Jan 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.0.473, 1.1.6
Also known as
GHSA-wv23-pfj7-2mjj
Sources
NVD, Project advisories (GitHub)

Description

October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with "create, modify and delete website pages" privileges in the backend is able to execute PHP code by running specially crafted Twig code in the template markup. The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to…

Affected software

SoftwareAffected versions
October CMSServers and applications · cpe:a:octobercms:october
  • Every version before 1.0.473
  • From 1.1.0 before 1.1.6
October CMSServers and applications · github:octobercms/october
  • Version 1.0.472
  • Version 1.1.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-32649
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-32649
  • GitHub Advisory Database https://github.com/advisories/GHSA-wv23-pfj7-2mjj
  • github.com https://github.com/octobercms/october/security/advisories/GHSA-wv23-pfj7-2mjj