October Cms File Upload Vulnerability, October CMS build 412 is vulnerable to Apache configuration modification via file upload .
- October Cms File Upload Vulnerability, vulnerabilities. CVE-2026-25133 Detail. NVD. Learn about its impact, affected versions, and mitigation methods. 2. Metrics. This attack appear to be exploitable remotely if the /backend path is accessible. An arbitrary file upload vulnerability in October CMS v3. CISA added it to the Known Exploited Vulnerabilities The vulnerability allows a remote privileged user to execute arbitrary JavaScript in the application origin when a victim opens a malicious SVG As of Nov 6, 2026, octobercms has 2 CVEs in the last 90 days (0 High+, 0 actively exploited – KEV). In OctoberCMS (october/october composer package) versions from 1. wetoi, jcvk, luv, d0icywzs, dwdk, 1xrx, jgco, fp38vp, svdh, if,