CVE-2021-32650 HIGH

CVE-2021-32650: Arbitrary code execution in october/system

Vendor Octobercms
Product october
Weakness CWE-74
Published January 14, 2022
Last update April 22, 2025
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with access to the backend is able to execute PHP code by using the theme import feature. This will bypass the safe mode feature that prevents PHP execution in the CMS templates.The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround.

Key dates

02Disclosure timeline

January 14, 2022 CVE published
April 22, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-7770 IBM i Access Client Solutions (ACS) is vulnerable to remote code execution when configured to listen for requests from IBM i Navigator CVE-2026-10223 NousResearch hermes-agent memory_tool.py _scan_memory_content injection CVE-2026-10222 NousResearch hermes-agent config.py _sanitize_env_lines injection CVE-2026-41319 MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade CVE-2026-10210 AstrBotDevs AstrBot skill_manager.py _sanitize_prompt_description injection