Arbitrary file upload in Octobercms October
CVE-2024-51991
October is a Content Management System (CMS) and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administrators with sites that have the `media.clean_vectors` configuration enabled. This configuration will sanitize SVG files uploaded using the media manager. This vulnerability allows an authenticated user to bypass this protection by uploading it with a permitted extension (for example, .jpg or .png) and later modifying it to the .svg extension. This vulnerability assumes a trusted user will attack another trusted user and cannot be actively exploited without access to the administration panel and interaction from the other user. This issue has been patched in v3.7.5.
Vulnerability class: Unrestricted File Upload
EPSS: 0.003 (26.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Octobercms October — versions < 3.7.5
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2024-51991?
- CVE-2024-51991 is a medium-severity vulnerability in Octobercms October, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 4.9/10. Published 2025-05-05.
- How severe is CVE-2024-51991?
- Medium severity. CVSS v3 base score is 4.9 out of 10.
- Is CVE-2024-51991 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.