UpHeron
All vulnerabilities

Servers and applications

CVE-2022-24800

RCE via race condition in upload process

Severity
High 8.1
Published
12 Jul 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.0.476, 1.1.12, 2.2.15
Also known as
GHSA-8v7h-cpc2-r8jp
Sources
NVD, Project advisories (GitHub)

Description

October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.476, 1.1.12, and 2.2.15, when the developer allows the user to specify their own filename in the `fromData` method, an unauthenticated user can perform remote code execution (RCE) by exploiting a race condition in the temporary storage directory. This…

Affected software

SoftwareAffected versions
October CMSServers and applications · cpe:a:octobercms:october
  • Every version before 1.0.476
  • From 1.1.0 before 1.1.12
  • From 2.0.0 before 2.2.15
October CMSServers and applications · github:octobercms/october
  • Version 1.0.475
  • Version 1.1.11
  • Version 2.2.14

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-24800
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-24800
  • GitHub Advisory Database https://github.com/advisories/GHSA-8v7h-cpc2-r8jp
  • github.com https://github.com/octobercms/october/security/advisories/GHSA-8v7h-cpc2-r8jp