NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
MEDIUM severity

Reflected XSS when importing CSV in OctoberCMSGHSA-gg6x-xx78-448c

MEDIUMFix: octobercms/october@cd0b6a7

GHSA-gg6x-xx78-448c is a medium-severity (CVSS 4) CWE-87 vulnerability in october/backend. 2 public exploit or proof-of-concept references are indexed, so weaponization risk is real. A fix is available for october/backend — see the affected versions and patch details below.

Also known asCVE-2020-5298
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
2 known
Exploitation data as of Nov 5, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
0.9%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs60th percentile — riskier than 60% of all scored CVEsHighest risk
0.26%0.64%1.03%1.41%0.8%0.9%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected
🐘october/backend

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Impact

A user with the ability to use the import functionality of the ImportExportController behavior could be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question

Patches

Issue has been patched in Build 466 (v1.0.466).

Workarounds

Apply https://github.com/octobercms/october/commit/cd0b6a791f995d86071a024464c1702efc50f46c to your installation manually if unable to upgrade to Build 466.

References

Reported by Sivanesh Ashok

For more information

If you have any questions or comments about this advisory:

Threat assessment:

<img width="1100" alt="Screen Shot 2020-03-31 at 2 01 52 PM" src="https://user-images.githubusercontent.com/7253840/78070158-8f7ef580-7358-11ea-950c-226533f6a0a3.png">

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistoctober/backend≥ 1.0.319&&< 1.0.4661.0.466composer require october/backend:^1.0.466

Affected Products

1 product · 1 configurations
Application
octoberoctobercms
≥ 1.0.319 && < 1.0.466
range
Exploits & PoCs
2

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

In OctoberCMS (october/october composer package) versions from 1.0.319 a…

packetstormsecurity.comNVDJun 2022

Report on seclists.org

seclists.orgNVDJun 2022

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for october/backend, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update october/backend to 1.0.466 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-gg6x-xx78-448c is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

### Impact A user with the ability to use the import functionality of the `ImportExportController` behavior could be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question ### Patches Issue has been patched in Build 466 (v1.0.466). ### Workarounds Apply https://github.com/octobercms/october/commit/cd0b6a791f995d86071a024464c1702efc50f46c to your installation manually if unable to upgrade to Build 466. ### References Reported by [Sivanesh Ashok](https://stazot.com/) ### For more information If you have
O3 Security · Impact-Aware SCA

Is GHSA-gg6x-xx78-448c in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
Reflected XSS when importing CSV in OctoberCMS