Medium severity6.8NVD Advisory· Published Mar 10, 2021· Updated Jun 17, 2026
CVE-2021-21265
CVE-2021-21265
Description
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. This has been addressed in version 1.1.2 by adding a feature to allow a set of trusted hosts to be specified in the application. As a workaround one may set the configuration setting cms.linkPolicy to force.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
october/backendPackagist | < 1.1.2 | 1.1.2 |
Affected products
3cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*range: <1.1.2
- (no CPE)range: < 1.1.2
Patches
Vulnerability mechanics
References
8- github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6nvdPatchThird Party AdvisoryWEB
- github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0nvdPatchThird Party AdvisoryWEB
- github.com/octobercms/october/security/advisories/GHSA-xhfx-hgmf-v6vpnvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-xhfx-hgmf-v6vpghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-21265ghsaADVISORY
- github.com/octobercms/library/commit/f29865ae3db7a03be7c49294cd93980ec457f10dnvdWEB
- github.com/octobercms/october/commit/555ab61f2313f45d7d5d138656420ead536c5d30nvdWEB
- packagist.org/packages/october/backendnvdWEB
News mentions
0No linked articles in our index yet.