Composer october/cms has 8 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2017-1000119 | October CMS PHP Code Execution | high | 7.2 | <=1.0.412 | – |
| CVE-2020-5295 | Local File read vulnerability in OctoberCMS | medium | 4.8 | >=1.0.319 and <1.0.466 | 1.0.466 |
| CVE-2020-15246 | Local File Inclusion by unauthenticated users | high | 7.5 | >=1.0.421 and <1.0.469 | 1.0.469 |
| CVE-2020-5296 | Arbitrary File Deletion vulnerability in OctoberCMS | medium | 6.2 | >=1.0.319 and <1.0.466 | 1.0.466 |
| CVE-2020-5297 | Upload whitelisted files to any directory in OctoberCMS | low | 3.4 | >=1.0.319 and <1.0.466 | 1.0.466 |
| CVE-2020-15247 | Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled. | medium | 5.2 | >=1.0.319 and <1.0.469 | 1.0.469 |
| CVE-2020-26231 | Bypass of fix for CVE-2020-15247, Twig sandbox escape | medium | 5.2 | >=1.0.469 and <1.0.470 | 1.0.470 |
| CVE-2021-21264 | Bypass of fix for CVE-2020-26231, Twig sandbox escape | medium | 5.2 | >=1.0.471 and <1.0.472 or >=1.1.1 and <1.1.2 | 1.0.472, 1.1.2 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked