octobercms/october
4.x@ 21d0678Fixes9
CVEs49
Peak severityCritical
Commits11,426
Regression coverage71.4%
Highlights
Restricted File Upload Bypass: 2 prior fixes. Scrutinize any change in this area.
modules/backend/controllers/Auth.php: most-fixed (1 issue). Treat as high-risk during review.
9 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
Cross-Site Request Forgery: 1 historical fix(es) link modules/cms/classes/Controller.php to Cross-Site Request Forgery.
Cross-Site Scripting: 1 historical fix(es) link modules/system/assets/js/framework.js to Cross-Site Scripting.
Open Redirect: 1 historical fix(es) link modules/backend/controllers/Auth.php to Open Redirect.
Last analyzed 10 Oct 2026, 05:40 UTC