CVE-2018-1999009: October CMS October

High severity, CVSS 8.1. EPSS: 2.4% chance of exploitation in the next 30 days.

October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244 (makeFileContents function) that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend path is accessible. This vulnerability appears to have been fixed in Build 437.

Affected products

• October CMS October: affected versions not specified

Published 2018-07-23. Last modified 2026-06-17.