CVE-2022-24800

    Dashboard / Vulnerabilities / CVE-2022-24800

    CVE-2022-24800

    Published: 12 Jul 2022Last Modified: 22 Sept 2026

    Summary: Race Condition in October CMS upload process

    Details: October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.476, 1.1.12, and 2.2.15, when the developer allows the user to specify their own filename in the `fromData` method, an unauthenticated user can perform remote code execution (RCE) by exploiting a race condition in the temporary storage directory. This vulnerability affects plugins that expose the `October\Rain\Database\Attach\File::fromData` as a public interface and does not affect vanilla installations of October CMS since this method is not exposed or used by the system internally or externally. The issue has been patched in Build 476 (v1.0.476), v1.1.12, and v2.2.15. Those who are unable to upgrade may apply with patch to their installation manually as a workaround.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24800.json, https://github.com/octobercms/october/security/advisories/GHSA-8v7h-cpc2-r8jp, https://nvd.nist.gov/vuln/detail/CVE-2022-24800, https://github.com/octobercms/library/commit/fe569f3babf3f593be2b1e0a4ae0283506127a83

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    v1.1.10
    v1.1.9
    v1.1.8
    v1.1.7
    v1.1.5
    v1.1.4
    v1.1.3
    v1.1.1
    v1.1.0
    v1.1.6
    v1.1.2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-24800 | CVE-DB