CVE-2017-16941

    Dashboard / Vulnerabilities / CVE-2017-16941

    CVE-2017-16941

    Published: 25 Nov 2017Last Modified: 7 Aug 2026

    Summary:

    Details: October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a .htaccess file. NOTE: the vendor says "I don't think [an attacker able to login to the system under an account that has access to manage/upload themes] is a threat model that we need to be considering.

    References: https://github.com/octobercms/october/issues/3257

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    v1.0.428
    v1.0.427
    v1.0.426
    v1.0.425
    v1.0.424
    v1.0.423
    v1.0.422
    v1.0.421
    v1.0.419
    v1.0.420
    v1.0.415
    v1.0.418
    v1.0.417
    v1.0.416
    v1.0.414
    v1.0.413
    v1.0.411
    v1.0.412
    v1.0.410
    v1.0.409
    v1.0.408
    v1.0.407
    v1.0.406
    v1.0.405
    v1.0.404
    v1.0.396
    v1.0.403
    v1.0.402
    v1.0.401
    v1.0.400
    v1.0.399
    v1.0.398
    v1.0.397
    v1.0.395
    v1.0.394
    v1.0.393
    v1.0.392
    v1.0.391
    v1.0.390
    v1.0.389
    v1.0.388
    v1.0.387
    v1.0.386
    v1.0.385
    v1.0.384
    v1.0.383
    v1.0.382
    v1.0.381
    v1.0.380
    v1.0.379
    v1.0.378
    v1.0.377
    v1.0.376
    v1.0.375
    v1.0.374
    v1.0.373
    v1.0.372
    v1.0.371
    v1.0.370
    v1.0.367
    v1.0.366
    v1.0.365
    v1.0.364
    v1.0.363
    v1.0.362
    v1.0.361
    v1.0.360
    v1.0.359
    v1.0.358
    v1.0.356
    v1.0.355
    v1.0.354
    v1.0.353
    v1.0.352
    v1.0.351
    v1.0.346
    v1.0.345
    v1.0.344
    v1.0.343
    v1.0.342
    v1.0.341
    v1.0.340
    v1.0.338
    v1.0.334
    v1.0.333
    v1.0.331
    v1.0.330
    v1.0.329
    v1.0.328
    v1.0.327
    v1.0.326
    v1.0.325
    v1.0.324
    v1.0.323
    v1.0.322
    v1.0.321
    v1.0.320
    v1.0.319

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2017-16941 | CVE-DB