CVE-2020-15249
lowpriority · track · 22EPSS 0.005 · 40 %ileEUUSEPSS · scored 2026-10-27
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, backend users with access to upload files were permitted to upload SVG files without any sanitization applied to the uploaded files. Since SVG files support being parsed as HTML by browsers, this means that they could theoretically upload Javascript that would be executed on a path under the website's domain (i.e. /storage/app/media/evil.svg), but they would have to convince their target to visit that location directly in the target's browser as the backend does not display SVGs inline anywhere, SVGs are only displayed as image resources in the backend and are thus unable to be executed. Issue has been patched in Build 469 (v1.0.469) & v1.1.0.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 2.8–5.4
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-fx3v-553x-3c4qStored XSS by authenticated backend user with access to upload files2020-11-23ghsa · osvUS
### Impact Backend users with access to upload files were permitted to upload SVG files without any sanitization applied to the uploaded files. Since SVG files support being parsed as HTML by browsers, this means that they could theoretically upload Javascript that would be executed on a path under the website's domain (i.e. /storage/app/media/evil.svg), but they would have to convince their target to visit that location directly in the target's browser as the backend does not display SVGs inline anywhere, SVGs are only displayed as image resources in the backend and are thus unable to be executed. ### Patches Issue has been patched in Build 469 (v1.0.469) & v1.1.0. ### Workarounds Apply https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4 to your installation manually if unable to upgrade to Build 469 or v1.1.0. ### References Reported by [Hoan Hoang](https://github.com/hoanhp) ### For more information If you have any questions or comments about this advisory: * Email us at [hello@octobercms.com](mailto:hello@octobercms.com) ### Threat assessment: <img width="1107" alt="Screen Shot 2020-10-10 at 1 47 49 PM" src="https://user-images.githubusercontent.com/7253840/95663787-378f2b80-0aff-11eb-8dfc-b97d162939da.png">
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4cnnvd
- https://github.com/octobercms/october/security/advisories/GHSA-fx3v-553x-3c4qcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-15249cnnvd
- https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4enisa_euvd
- https://github.com/octobercms/october/security/advisories/GHSA-fx3v-553x-3c4qenisa_euvd
- https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4PatchThird Party Advisorynvd
- https://github.com/octobercms/october/security/advisories/GHSA-fx3v-553x-3c4qThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan