PHP package security
Is october/system vulnerable?
25 known security advisories for october/system. The latest was reported on 2026-09-14 and is fixed in 3.7.17 and 4.2.23. The newest release, 1.1.12, is inside the affected range of 10 of them.
1 critical 8 high 9 medium 7 low
- Known advisories
- 25
- Newest release
- 1.1.12
- Released
- 2022-02-20
- Affecting newest release
- 10
- Last synced
- 2026-11-03
Check your version
Security advisories for october/system
| Reported | Advisory | Severity | Affected | Fixed in |
|---|---|---|---|---|
| 2026-09-14 | October CMS: PHP Object Injection via Backend Widget Session Storage GHSA-2ff2-mx52-q8wp · CVE-2026-49400 · GitHub | low | >=4.0.0,<4.2.23 | <3.7.17 | 3.7.17, 4.2.23 |
| 2026-09-14 | October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls GHSA-xv9m-fm3w-8w5x · CVE-2026-46696 · GitHub | low | >=4.0.0,<4.2.23 | <3.7.17 | 3.7.17, 4.2.23 |
| 2026-04-21 | October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations GHSA-jvwg-phxx-j3rp · CVE-2026-29179 · GitHub | low | <3.7.16 | >=4.0.0,<4.1.16 | 3.7.16, 4.1.16 |
| 2026-04-21 | October CMS: Reflected XSS via DataTable Form Widget GHSA-jj38-h5w5-mvpf · CVE-2026-27937 · GitHub | low | >=4.0.0,<4.1.16 | <3.7.16 | 3.7.16, 4.1.16 |
| 2026-04-21 | October CMS has Safe Mode Bypass via CSS Preprocessor Compilers GHSA-3888-q23f-x7qh · CVE-2026-26067 · GitHub | medium | >=4.0.0,<4.1.10 | <3.7.14 | 3.7.14, 4.1.10 |
| 2026-04-14 | October CMS has Stored XSS in Event Log Mail Preview GHSA-j4j5-9x6g-rgxc · CVE-2026-24907 · GitHub | medium | <=3.7.13 | >=4.0.0,<=4.1.9 | not stated |
| 2026-04-14 | October CMS has Stored XSS in Backend Editor Markup Classes GHSA-6qmh-j78v-ffp7 · CVE-2026-24906 · GitHub | medium | <=3.7.13 | >=4.0.0,<=4.1.9 | not stated |
| 2026-01-09 | October CMS Vulnerable to Stored XSS via Branding Styles GHSA-wvpq-h33f-8rp6 · CVE-2025-61676 · GitHub | medium | >=4.0.0,<=4.0.11 | <=3.7.12 | not stated |
| 2026-01-09 | October CMS Vulnerable to Stored XSS via Editor and Branding Styles GHSA-gxxc-m74c-f48x · CVE-2025-61674 · GitHub | medium | >=4.0.0,<=4.0.11 | <=3.7.12 | not stated |
| 2025-05-05 | October CMS Allows Unprotected SVG Rename in Media Manager GHSA-96hh-8hx5-cpw7 · CVE-2024-51991 · GitHub | low | <3.7.5 | 3.7.5 |
| 2024-06-26 | October System module has an Open Redirect for Administrator Accounts GHSA-v2vf-jv88-3fp5 · CVE-2024-24764 · GitHub | low | >=3.2,<3.5.15 | 3.5.15 |
| 2024-06-26 | October System module has a Reflected XSS via X-October-Request-Handler Header GHSA-rjw8-v7rr-r563 · CVE-2024-25637 · GitHub | low | >=3.2,<3.5.15 | 3.5.15 |
| 2023-11-29 | October CMS stored XSS by authenticated backend user with improper configuration GHSA-rvx8-p3xp-fj3p · CVE-2023-44383 · GitHub | medium | >=3.0.0,<3.5.2 | 3.5.2 |
| 2023-11-29 | October CMS safe mode bypass using Twig sandbox escape GHSA-p8q3-h652-65vx · CVE-2023-44382 · GitHub | critical | >=3.0.0,<3.4.15 | 3.4.15 |
| 2023-11-29 | October CMS safe mode bypass using Page template injection GHSA-q22j-5r3g-9hmh · CVE-2023-44381 · GitHub | medium | >=3.0.0,<3.4.15 | 3.4.15 |
| 2022-10-13 | October CMS Safe Mode bypass leads to authenticated Remote Code Execution GHSA-x4q7-m6fp-4v9v · CVE-2022-35944 · GitHub | high | >=2.0.0,<2.2.34 | >=3.0.0,<3.0.66 | 2.2.34, 3.0.66 |
| 2022-07-13 | October CMS upload process vulnerable to RCE via Race Condition GHSA-8v7h-cpc2-r8jp · CVE-2022-24800 · GitHub | high | >=2.0.0,<2.2.15 | >=1.1.0,<1.1.12 | <1.0.476 | 1.0.476, 1.1.12, 2.2.15 |
| 2022-02-24 | Missing server signature validation in OctoberCMS GHSA-53m6-44rc-h2q5 · CVE-2022-23655 · GitHub | medium | <1.0.475 | >=1.1.0,<1.1.11 | 1.0.475, 1.1.11 |
| 2022-02-23 | Authenticated remote code execution in October CMS GHSA-79jw-2f46-wv22 · CVE-2022-21705 · GitHub | high | >=2.0.0,<2.1.27 | >=1.1.0,<1.1.10 | <1.0.474 | 1.0.474, 1.1.10, 2.1.27 |
| 2022-01-14 | october/system arbitrary code execution GHSA-5hfj-r725-wpc4 · CVE-2021-32650 · GitHub | high | <1.0.473 | >=1.1.0,<1.1.6 | 1.0.473, 1.1.6 |
| 2022-01-14 | October/System authenticated file write leads to remote code execution GHSA-wv23-pfj7-2mjj · CVE-2021-32649 · GitHub | high | <1.0.473 | >=1.1.0,<1.1.6 | 1.0.473, 1.1.6 |
| 2021-10-06 | Deleted Admin Can Sign In to Admin Interface GHSA-6gjf-7w99-j7x7 · CVE-2021-41126 · GitHub | high | >=2.1.0,<2.1.12 | 2.1.12 |
| 2021-08-30 | October CMS auth bypass and account takeover GHSA-h76r-vgf3-j6w5 · CVE-2021-29487 · GitHub | high | >=1.1.1,<1.1.5 | <1.0.472 | 1.0.472, 1.1.5 |
| 2021-08-30 | Account Takeover in Octobercms GHSA-mxr5-mc97-63rc · CVE-2021-32648 · GitHub | high | >=1.1.1,<1.1.5 | <1.0.472 | 1.0.472, 1.1.5 |
| 2020-06-05 | Use of insecure jQuery version in OctoberCMS GHSA-v73w-r9xg-7cr9 · GitHub | medium | >=1.0.319,<1.0.466 | 1.0.466 |
Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.
Ask about a fixCheck your whole project. Paste your composer.lock and see every installed package with a known advisory. Nothing is stored.
Check composer.lockQuestions about october/system
Does october/system have known vulnerabilities?
Yes. Packagist lists 25 security advisories for october/system (1 critical, 8 high, 9 medium, 7 low severity). The most recent, reported 2026-09-14, is "October CMS: PHP Object Injection via Backend Widget Session Storage". The newest release, 1.1.12, is still inside the affected range of 10 of them.
Which version of october/system should I run?
The newest stable release is 1.1.12 (published 2022-02-20). The most recent advisory is fixed in 3.7.17 and 4.2.23, so stay on or above the fixed version for your major version. Run composer update october/system, then composer audit to confirm nothing else is flagged.
How do I check if my october/system version is affected?
Run composer show october/system in your project to see the installed version, then enter it in the version check on this page. You can also run composer audit, which reads the same Packagist advisory data for every package in your composer.lock.