Most recent entries from all

cnvd-2020-38888

2026-10-06T06:05:06.836458+00:00

cnvd-2020-38888

EUVD-2026-36519

2026-10-06T06:05:06.836494+00:00

EUVD-2026-36519

fkie_cve-2020-5298

2026-10-06T06:05:06.836509+00:00

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the `ImportExportController` behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question Issue has been patched in Build 466 (v1.0.466).

GHSA-gg6x-xx78-448c — Reflected XSS when importing CSV in OctoberCMS

2026-10-06T06:05:06.836537+00:00

Affected: Packagist: october/backend

### Impact A user with the ability to use the import functionality of the `ImportExportController` behavior could be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question

### Patches Issue has been patched in Build 466 (v1.0.466).

### Workarounds Apply https://github.com/octobercms/october/commit/cd0b6a791f995d86071a024464c1702efc50f46c to your installation manually if unable to upgrade to Build 466.

### References Reported by [Sivanesh Ashok](https://stazot.com/)

### For more information If you have any questions or comments about this advisory: * Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:

gsd-2020-5298

2026-10-06T06:05:06.836569+00:00

gsd-2020-5298