← Vulnerability feed

Vulnerability record · CVE-2017-1000119 · published 5 October 2017

CVE-2017-1000119: October CMS file upload flaw allows PHP code execution

Octobercms · October

October CMS build 412 permits unrestricted file uploads that lead to PHP code execution. An attacker who can reach the upload functionality can place executable code on the server, compromising the site and potentially other applications on the same host.

7.2 CVSS 3.0 High EPSS 61% · top 0.9% CWE-434 · Unrestricted file upload
7.2CVSS 3.0 base score, v2 6.5
61%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server.

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe flaw yields code execution and has a very high EPSS score, though exploitation requires high privileges and no KEV listing exists.

What it is

October CMS build 412 permits unrestricted file uploads that lead to PHP code execution. An attacker who can reach the upload functionality can place executable code on the server, compromising the site and potentially other applications on the same host.

Impact

Successful exploitation gives the attacker arbitrary PHP code execution in the web server context, enabling full site compromise and possible lateral impact on other applications on the server.

Attack surface

Reached over the network through the file upload functionality; the CVSS vector indicates high privileges are required (PR:H) and no user interaction is needed (UI:N).

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is high (0.61347, 99.123rd percentile) and a public Packet Storm advisory describes an upload protection bypass with code execution.

What to do

  • Upgrade October CMS past build 412 per the vendor advisory (rn-8).
  • Restrict upload functionality to trusted, authenticated administrative users only.
  • Enforce server-side validation of file type and extension and store uploads outside the web root.
  • Disable PHP execution in upload directories and apply least privilege to the web server user.
  • Monitor the vendor advisory for further guidance if upgrading is delayed.

Detection

  • Alert on PHP files or other executable content appearing in upload directories.
  • Review web server logs for POST requests to upload endpoints followed by requests to newly written files.
  • Monitor for unexpected child processes spawned by the web server user.
  • Audit file integrity in web-accessible directories for new or modified scripts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://octobercms.com/support/article/rn-8 Vendor Advisory
http://packetstormsecurity.com/files/154390/October-CMS-Upload-Protection-Bypass-Code-Execution.html
http://octobercms.com/support/article/rn-8 Vendor Advisory
http://packetstormsecurity.com/files/154390/October-CMS-Upload-Protection-Bypass-Code-Execution.html

Track CVE-2017-1000119 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2021-32648October CMS password reset authentication bypassOctober CMS, a Laravel-based CMS, contains an improper authentication flaw in the october/system package. An attacker can request an account password…KEVEPSS 90%analysed9.8CVE-2021-3311Octobercms october insufficient session expiration vulnerabilityAn issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occur…EPSS 2.9%9.8CVE-2017-1000194Octobercms october unrestricted file upload vulnerabilityOctober CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly othe…EPSS 1.2%9.8CVE-2017-1000196Octobercms october code injection vulnerabilityOctober CMS build 412 is vulnerable to PHP code execution in the asset manager functionality resulting in site compromise and possibly other applicat…EPSS 1.9%9.8CVE-2017-1000197Octobercms october vulnerabilityOctober CMS build 412 is vulnerable to file path modification in asset move functionality resulting in creating creating malicious files on the serve…EPSS 1.2%9.1CVE-2023-44382Octobercms october code injection vulnerabilityOctober is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `editor.cms…EPSS 0.87%8.8CVE-2021-32649Octobercms october injection vulnerabilityOctober CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an att…EPSS 1.3%8.8CVE-2021-32650Octobercms october injection vulnerabilityOctober CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an att…EPSS 2.1%

Source: NIST National Vulnerability Database (record CVE-2017-1000119), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.