CVE-2020-5298 - CVE House
Back to Database
Status published Medium CVE-2020-5298

Reflected XSS when importing CSV in OctoberCMS

Vulnerability Description

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the `ImportExportController` behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question Issue has been patched in Build 466 (v1.0.466).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-5298

Credits & Attribution

No credits recorded in the NVD database.

References

More from octobercms

View All →
CVE-2025-61676
October CMS Vulnerable to Stored XSS via Branding Styles
Medium 6.1
CVE-2025-61674
October CMS Vulnerable to Stored XSS via Editor and Branding Styles
Medium 6.1
CVE-2024-51991
October CMS Allows Unprotected SVG Rename in Media Manager
Low 1.1
CVE-2024-25637
Reflected XSS via X-October-Request-Handler Header
Low 3.1
CVE-2024-24764
October Open Redirect for Administrator Accounts
Low 3.5

Affected Vendor

Affected Software

october
Vulnerable Versions:
>= 1.0.319, < 1.0.466

Timeline

Official Publish: June 3rd, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-87

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.