UpHeron
All vulnerabilities

Servers and applications

CVE-2021-32650

Arbitrary code execution

Severity
High 8.8
Published
14 Jan 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Also known as
GHSA-5hfj-r725-wpc4
Sources
NVD, Project advisories (GitHub)

Description

October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with access to the backend is able to execute PHP code by using the theme import feature. This will bypass the safe mode feature that prevents PHP execution in the CMS templates.The issue has been patched in Build 473 (v1.0.473) and v1.1.6.…

Affected software

SoftwareAffected versions
October CMSServers and applications · cpe:a:octobercms:october
  • Version 1.0.472
  • Version 1.1.5
October CMSServers and applications · github:octobercms/october
  • Version 1.0.472
  • Version 1.1.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-32650
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-32650
  • GitHub Advisory Database https://github.com/advisories/GHSA-5hfj-r725-wpc4
  • github.com https://github.com/octobercms/october/security/advisories/GHSA-5hfj-r725-wpc4