Vulnerability report

No Exploitation Yet

CVE-2024-51991

october

October CMS / october · affected before 3.7.5

Watch CVE-2024-51991 Browse KEV feed
Severity
CVSS 1.1 · Low
Confidence
—
Exploit status
—
EPSS
—
First observed
—
Last observed
—

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2024-51991 is a vulnerability affecting October CMS october. October is a Content Management System (CMS) and web platform.

Have exploitation attempts been observed?

No. Previdian has not recorded exploitation attempts for this vulnerability yet.

Who is affected?

October CMS / october affected before 3.7.5.

What should we do?

Track for updates. Assess relevance to your asset inventory and enrichment workflows.

Overview

October is a Content Management System (CMS) and web platform

October is a Content Management System (CMS) and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administrators with sites that have the `media.clean_vectors` configuration enabled. This configuration will sanitize SVG files uploaded using the media manager.

This vulnerability allows an authenticated user to bypass this protection by uploading it with a permitted extension (for example, .jpg or .png) and later modifying it to the .svg extension. This vulnerability assumes a trusted user will attack another trusted user and cannot be actively exploited without access to the administration panel and interaction from the other user. This issue has been patched in v3.7.5.

octobercms Affected
october
Before 3.7.5
Published
05 May 2025
Exploitation date
—
Attack vector
Remote
Complexity
Low
Privileges
High
User interaction
—

CVE References

Exploitation evidence

Exploitation evidence for this CVE

Catalogues and sources that list this CVE as a known exploited vulnerability, when available.

No exploitation evidence rows are recorded for this CVE yet.

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

No detection artifacts or sensor request patterns are available for this CVE yet.

Check back as sensor telemetry and scanner integrations are updated.

Risk and context

Severity, weaknesses, and research context

CVSS v4.0

1.1 Low

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U

EPSS

—

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Unrestricted Upload of File with Dangerous Type CWE-434

Timeline

From disclosure to today

  1. 17:04 UTC

    CVE published

    Vulnerability disclosed publicly

  2. 17:46 UTC

    CVE ID reserved

    Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs
  • Evidence confidence and provenance
  • First-party sensor telemetry
  • PoC and scanner references
  • Affected versions and enrichment
  • Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2024-51991

Sample API response 
{
  "cve_id": "CVE-2024-51991",
  "confidence": null,
  "cvss_score": 1.1,
  "cvss_estimated": false,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": false,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}