CVE-2018-1999009 - CVE House
Back to Database
Status published High CVE-2018-1999009

October CMS version prior to Build 437 contains a Local...

Vulnerability Description

October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244 (makeFileContents function) that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend path is accessible. This vulnerability appears to have been fixed in Build 437.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-1999009

Credits & Attribution

No credits recorded in the NVD database.

References

More from octobercms

View All →
CVE-2025-61676
October CMS Vulnerable to Stored XSS via Branding Styles
Medium 6.1
CVE-2025-61674
October CMS Vulnerable to Stored XSS via Editor and Branding Styles
Medium 6.1
CVE-2024-51991
October CMS Allows Unprotected SVG Rename in Media Manager
Low 1.1
CVE-2024-25637
Reflected XSS via X-October-Request-Handler Header
Low 3.1
CVE-2024-24764
October Open Redirect for Administrator Accounts
Low 3.5

Affected Vendor

Affected Software

october
Vulnerable Versions:
Unknown

Timeline

Official Publish: July 23rd, 2018
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.