VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Jun 3, 2020· Updated Aug 4, 2024

Reflected XSS when importing CSV in OctoberCMS

CVE-2020-5298

Description

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the ImportExportController behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question Issue has been patched in Build 466 (v1.0.466).

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
october/backendPackagist
>= 1.0.319, < 1.0.4661.0.466

Affected products

1

Patches

1
cd0b6a791f99

escape import CSV column names

https://github.com/octobercms/octoberLuke TowersMar 31, 2020via ghsa
commit
1 file changed · +1 −1
  • modules/backend/behaviors/importexportcontroller/partials/_import_file_columns.htm+1 −1 modified
    @@ -22,7 +22,7 @@
                                 class="column-label"
                                 onclick="$.oc.importBehavior.loadFileColumnSample(this)"
                             >
-                                <?= $column ?>
+                                <?= e($column) ?>
                             </a>
                         </span>
                     </div>

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.