Security: octobercms/october
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Editor Sub-Permission Bypass for Asset and Blueprint File OperationsGHSA-jvwg-phxx-j3rp published
Apr 21, 2026 by daftspunkLow -
Reflected XSS via DataTable Form WidgetGHSA-jj38-h5w5-mvpf published
Apr 21, 2026 by daftspunkLow -
Safe Mode Bypass via Twig Database Write OperationsGHSA-h6jm-f4hh-fw27 published
Apr 21, 2026 by daftspunkModerate -
Safe Mode Bypass via CSS Preprocessor CompilersGHSA-3888-q23f-x7qh published
Apr 21, 2026 by daftspunkModerate -
Stored XSS via SVG Filter BypassGHSA-gcqv-f29m-67gr published
Apr 14, 2026 by daftspunkModerate -
Environment Variable Exfiltration via INI Parser InterpolationGHSA-g6v3-wv4j-x9hg published
Apr 14, 2026 by daftspunkModerate -
Stored XSS in Backend Editor Markup ClassesGHSA-6qmh-j78v-ffp7 published
Apr 14, 2026 by daftspunkModerate -
Stored XSS in Event Log Mail PreviewGHSA-j4j5-9x6g-rgxc published
Apr 14, 2026 by daftspunkModerate -
Twig Sandbox Bypass via Collection MethodsGHSA-m5qg-jc75-4jp6 published
Apr 14, 2026 by daftspunkModerate -
Stored XSS via Branding StylesGHSA-wvpq-h33f-8rp6 published
Jan 9, 2026 by daftspunkModerate