What’s Vulnerable › Vulnerabilities
CVE-2018-1999009
- Severity: high (CVSS 8.1 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-07-23 · updated 2026-06-17
- Weakness: CWE-200
Description
October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244 (makeFileContents function) that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend path is accessible. This vulnerability appears to have been fixed in Build 437.
Affected products
- octobercms october: all versions
References
Get alerted when CVE-2018-1999009 or the next vulnerability affects your stack