Executive brief
October CMS Allows Unprotected SVG Rename in Media Manager
Affected products
- Packagist october/system
- Packagist october/october
Junglewise Threat Intelligence
CVE-2024-51991: October CMS Allows Unprotected SVG Rename in Media Manager
CVE-2024-51991 · Severity: medium · CVSS 4 · Published 2025-05-05
Technologies: october/system (Packagist), october/october (Packagist). Vendors: Packagist.
Related threats
- October CMS: Incomplete Scheme Validation in Image Resizer
- October CMS incomplete URL scheme validation in image resizer
- October allows an admin account to upload PDF containing malicious JavaScript
- October System module has an Open Redirect for Administrator Accounts
- October System module has a Reflected XSS via X-October-Request-Handler Header