What’s Vulnerable › Vulnerabilities

CVE-2020-15246: Local File Inclusion by unauthenticated users

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-11-23 · updated 2026-06-17
• Weakness: CWE-863

Description

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.421 and before version 1.0.469, an attacker can read local files on an October CMS server via a specially crafted request. Issue has been patched in Build 469 (v1.0.469) and v1.1.0.

Affected products

• octobercms october: from 1.0.421 before 1.0.469 — fixed in 1.0.469

How to fix

Upgrade to a fixed version: octobercms october 1.0.469. Check the vendor advisory for mitigations.

References

• https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4
• https://github.com/octobercms/october/security/advisories/GHSA-xwjr-6fj7-fc6h
• https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4
• https://github.com/octobercms/october/security/advisories/GHSA-xwjr-6fj7-fc6h

Get alerted when CVE-2020-15246 or the next vulnerability affects your stack