CVE Feed

    Dashboard / CVE / CVE-2022-24800

    CVE-2022-24800

    October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.476, 1.1.12, and 2.2.15, when the developer allows the user to specify their own filename in the `fromData` method, an unauthenticated user can perform remote code execution (RCE) by exploiting a race condition in the temporary storage directory. This vulnerability affects plugins that expose the `October\Rain\Database\Attach\File::fromData` as a public interface and does not affect vanilla installations of October CMS since this method is not exposed or used by the system internally or externally. The issue has been patched in Build 476 (v1.0.476), v1.1.12, and v2.2.15. Those who are unable to upgrade may apply with patch to their installation manually as a workaround.

    Published:Jul 12, 2022
    Last Modified:Apr 23, 2025
    EPS:Jul 12, 2022
    EPSS Score:0.02925
    CVSS Score:8.1

    Affected Products

    Vendor
    Octobercms
    Product
    October

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-29179 (CVSS 3.3) — October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, fine-grained sub-pe…
    CVE-2026-27937 (CVSS 3.1) — October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-S…
    CVE-2026-26274 (CVSS 6.6) — October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a vulnerability was…
    CVE-2026-26067 (CVSS 4.9) — October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a server-side infor…
    CVE-2026-25133 (CVSS 4.8) — October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a s…
    CVE-2026-25125 (CVSS 4.9) — October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a s…
    CVE-2026-24907 (CVSS 5.1) — October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a s…
    CVE-2026-24906 (CVSS 5.1) — October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a S…
    CVE-2026-22692 (CVSS 4.9) — October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 thr…
    CVE-2025-61674 (CVSS 6.1) — October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-si…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High