CVE-2024-51991

LOW EPSS 22.3%
Published May 5, 20251y ago · Modified Jun 17, 20261w ago
1.1 CVSS 4.0
Low
Find Similar
Published May 5, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

October is a Content Management System (CMS) and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administrators with sites that have the `media.clean_vectors` configuration enabled. This configuration will sanitize SVG files uploaded using the media manager. This vulnerability allows an authenticated user to bypass this protection by uploading it with a permitted extension (for example, .jpg or .png) and later modifying it to the .svg extension. This vulnerability assumes a trusted user will attack another trusted user and cannot be actively exploited without access to the administration panel and interaction from the other user. This issue has been patched in v3.7.5.

CVSS Details

Base Score
1.1
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction P
Scope X

Threat Intelligence

EPSS Exploit Probability
22.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-434 Unrestricted Upload of File with Dangerous Type Resource Mgmt

Affected Products 1

VendorProductVersionRange
octobercmsoctober* <3.7.5

References 1

  • github.com https://github.com/octobercms/october/security/advisories/GHSA-96hh-8hx5-cpw7
    PatchVendor Advisory

Remediation

  • github.com https://github.com/octobercms/october/security/advisories/GHSA-96hh-8hx5-cpw7
    PatchVendor Advisory