Hoan Hoang

**Name of the Vulnerable Software and Affected Versions** October CMS versions 1.0.319 through 1.0.470 **Description** October CMS is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In affected versions, backend users with the default "Publisher" system role have access to create and manage users, allowing them to choose which role the new user has. This means that a user with "Publisher" access has the ability to escalate their access to "Developer" access. **Recommendations** For versions 1.0.319 through 1.0.470, update to Build 470 (v1.0.470) or v1.1.1 to resolve the issue. As a temporary workaround for versions that cannot be updated to Build 470 or v1.1.1, apply the manual patch from https://github.com/octobercms/october/commit/78a37298a4ed4602b383522344a31e311402d829 to your installation.

**Name of the Vulnerable Software and Affected Versions** October CMS versions 1.0.319 through 1.0.468 **Description** The issue allows backend users with access to upload files to upload SVG files without any sanitization applied to the uploaded files. Since SVG files support being parsed as HTML by browsers, this means that they could theoretically upload Javascript that would be executed on a path under the website's domain, but they would have to convince their target to visit that location directly in the target's browser. The backend does not display SVGs inline anywhere, and SVGs are only displayed as image resources in the backend and are thus unable to be executed. **Recommendations** For versions 1.0.319 through 1.0.468, update to Build 469 (v1.0.469) or v1.1.0 to resolve the issue. As a temporary workaround, consider applying the patch from https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4 to your installation manually if unable to upgrade to Build 469 or v1.1.0. Restrict access to uploading SVG files until the issue is resolved.