CVE-2022-24800

October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.476, 1.1.12, and 2.2.15, when the developer allows the user to specify their own filename in the `fromData` method, an unauthenticated user can perform remote code execution (RCE) by exploiting a race condition in the temporary storage directory. This vulnerability affects plugins that expose the `October\Rain\Database\Attach\File::fromData` as a public interface and does not affect vanilla installations of October CMS since this method is not exposed or used by the system internally or externally. The issue has been patched in Build 476 (v1.0.476), v1.1.12, and v2.2.15. Those who are unable to upgrade may apply with patch to their installation manually as a workaround.

• CWE-362

• https://github.com/octobercms/library/commit/fe569f3babf3f593be2b1e0a4ae0283506127a83Patch, Third Party Advisory
• https://github.com/octobercms/october/security/advisories/GHSA-8v7h-cpc2-r8jpPatch, Third Party Advisory
• https://github.com/octobercms/library/commit/fe569f3babf3f593be2b1e0a4ae0283506127a83Patch, Third Party Advisory
• https://github.com/octobercms/october/security/advisories/GHSA-8v7h-cpc2-r8jpPatch, Third Party Advisory

Published

Jul 12, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24795yajl-ruby is a C binding to the YAJL JSON parsing and genera…7.5
• CVE-2022-24796RaspberryMatic is a free and open-source operating system fo…9.8
• CVE-2022-24797Pomerium is an identity-aware access proxy. In distributed s…9.1
• CVE-2022-24798Internet Routing Registry daemon version 4 is an IRR databas…7.5
• CVE-2022-24799wire-webapp is the web application interface for the wire me…6.1
• CVE-2022-2480Use after free in Service Worker API in Google Chrome prior …8.8
• CVE-2022-24801Twisted is an event-based framework for internet application…8.1
• CVE-2022-24802deepmerge-ts is a typescript library providing functionality…9.8
• CVE-2022-24803Asciidoctor-include-ext is Asciidoctor’s standard include pr…9.8
• CVE-2022-24804Discourse is an open source platform for community discussio…5.3
• CVE-2022-24805net-snmp provides various tools relating to the Simple Netwo…8.8
• CVE-2022-24806net-snmp provides various tools relating to the Simple Netwo…5.3