Vulnerability record · CVE-2021-32649 · published 14 January 2022

CVE-2021-32649: Octobercms october injection vulnerability

Octobercms · October

October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with "create, modify and delete website pages" privileges in the backend is able to execute PHP code by running specially crafted Twig code in the template markup. The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround.

8.8 CVSS 3.1 High EPSS 1.3% · top 29.9% CWE-74 · InjectionCWE-94 · Code injection

8.8CVSS 3.1 base score, v2 6.5

1.3%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

October Octobercms

References

Link	Tags
https://github.com/octobercms/october/commit/167b592eed291ae1563c8fcc5b9b34a03a300f26	PatchThird Party Advisory
https://github.com/octobercms/october/security/advisories/GHSA-wv23-pfj7-2mjj	PatchThird Party Advisory
https://github.com/octobercms/october/commit/167b592eed291ae1563c8fcc5b9b34a03a300f26	PatchThird Party Advisory
https://github.com/octobercms/october/security/advisories/GHSA-wv23-pfj7-2mjj	PatchThird Party Advisory

Track CVE-2021-32649 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2021-32648October CMS password reset authentication bypassOctober CMS, a Laravel-based CMS, contains an improper authentication flaw in the october/system package. An attacker can request an account password…KEVEPSS 90%analysed26 Aug 2021 9.8CVE-2021-3311Octobercms october insufficient session expiration vulnerabilityAn issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occur…EPSS 2.9%5 Feb 2021 9.8CVE-2017-1000194Octobercms october unrestricted file upload vulnerabilityOctober CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly othe…EPSS 1.2%17 Nov 2017 9.8CVE-2017-1000196Octobercms october code injection vulnerabilityOctober CMS build 412 is vulnerable to PHP code execution in the asset manager functionality resulting in site compromise and possibly other applicat…EPSS 1.9%17 Nov 2017 9.8CVE-2017-1000197Octobercms october vulnerabilityOctober CMS build 412 is vulnerable to file path modification in asset move functionality resulting in creating creating malicious files on the serve…EPSS 1.2%17 Nov 2017 9.1CVE-2023-44382Octobercms october code injection vulnerabilityOctober is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `editor.cms…EPSS 0.87%1 Dec 2023 8.8CVE-2021-32650Octobercms october injection vulnerabilityOctober CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an att…EPSS 2.1%14 Jan 2022 8.8CVE-2017-16941Octobercms october unrestricted file upload vulnerabilityOctober CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by dow…EPSS 1.6%25 Nov 2017

Source: NIST National Vulnerability Database (record CVE-2021-32649), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.