Packagist/october/backend CVE-2021-21265: low, EPSS 1.75%

October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers

Action: Upgrade october/backend to 1.1.2 or later.

composer require october/backend:1.1.2

Affected

Fixed versions

Sources

• osv: GHSA-xhfx-hgmf-v6vp
• https://github.com/octobercms/october/security/advisories/GHSA-xhfx-hgmf-v6vp
• https://nvd.nist.gov/vuln/detail/CVE-2021-21265
• https://github.com/octobercms/library/commit/f29865ae3db7a03be7c49294cd93980ec457f10d
• https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6
• https://github.com/octobercms/october/commit/555ab61f2313f45d7d5d138656420ead536c5d30
• https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0
• https://packagist.org/packages/october/backend

CVE-2021-21265 · published 2021-03-10T21:07:25Z · modified 2026-07-08T06:28:47.054571329Z · JSON