VYPR
Get started
← All advisories
Low severityNVD Advisory· Published Jun 3, 2020· Updated Aug 4, 2024

Upload whitelisted files to any directory in OctoberCMS

CVE-2020-5297

Description

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, xml files to any directory of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the cms.manage_assets permission. Issue has been patched in Build 466 (v1.0.466).

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
october/cmsPackagist
>= 1.0.319, < 1.0.4661.0.466

Affected products

1

Patches

1
6711dae8ef70

Improve asset file path handling when moving assets

https://github.com/octobercms/octoberLuke TowersMar 31, 2020via ghsa
commit
1 file changed · +8 −1
  • modules/cms/widgets/AssetList.php+8 −1 modified
    @@ -333,13 +333,20 @@ public function onMove()
 
             $basename = basename($path);
             $originalFullPath = $this->getFullPath($path);
-            $newFullPath = rtrim($destinationFullPath, '/').'/'.$basename;
+            $newFullPath = realpath(rtrim($destinationFullPath, '/')) . '/' . $basename;
             $safeDir = $this->getAssetsPath();
 
             if ($originalFullPath == $newFullPath) {
                 continue;
             }
 
+            if (!starts_with($newFullPath, $safeDir)) {
+                throw new ApplicationException(Lang::get(
+                    'cms::lang.asset.error_moving_file',
+                    ['file' => $basename]
+                ));
+            }
+
             if (is_file($originalFullPath)) {
                 if (!@File::move($originalFullPath, $newFullPath)) {
                     throw new ApplicationException(Lang::get(

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.