CVE-2021-21265

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. This has been addressed in version 1.1.2 by adding a feature to allow a set of trusted hosts to be specified in the application. As a workaround one may set the configuration setting cms.linkPolicy to force.

• CWE-644

• https://github.com/octobercms/library/commit/f29865ae3db7a03be7c49294cd93980ec457f10d
• https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6Patch, Third Party Advisory
• https://github.com/octobercms/october/commit/555ab61f2313f45d7d5d138656420ead536c5d30
• https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0Patch, Third Party Advisory
• https://github.com/octobercms/october/security/advisories/GHSA-xhfx-hgmf-v6vpPatch, Third Party Advisory
• https://packagist.org/packages/october/backend
• https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6Patch, Third Party Advisory
• https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0Patch, Third Party Advisory
• https://github.com/octobercms/october/security/advisories/GHSA-xhfx-hgmf-v6vpPatch, Third Party Advisory

Published

Mar 10, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21259HedgeDoc is open source software which lets you create real-…6.1
• CVE-2021-2126Vulnerability in the Oracle VM VirtualBox product of Oracle …6
• CVE-2021-21260Online Invoicing System (OIS) is open source software which …5.4
• CVE-2021-21261Flatpak is a system for building, distributing, and running …8.8
• CVE-2021-21263Laravel is a web application framework. Versions of Laravel …5.3
• CVE-2021-21264October is a free, open-source, self-hosted CMS platform bas…5.2
• CVE-2021-21266openHAB is a vendor and technology agnostic open source auto…5
• CVE-2021-21267Schema-Inspector is an open-source tool to sanitize and vali…7.5
• CVE-2021-21269Keymaker is a Mastodon Community Finder based Matrix Communi…6.5
• CVE-2021-2127Vulnerability in the Oracle VM VirtualBox product of Oracle …4.4
• CVE-2021-21270OctopusDSC is a PowerShell module with DSC resources that ca…5.5
• CVE-2021-21271Tendermint Core is an open source Byzantine Fault Tolerant (…6.5