Is october/system safe to use?

october/system has 8 known vulnerabilities on the latest version (v1.1.12). DepScope rates its health at 33/100 (critical risk).

What is the latest version of october/system?

The latest version of october/system is v1.1.12, released 2022-02-20.

Does october/system have known vulnerabilities?

Yes. october/system has 8 known vulnerabilities. See depscope.dev/pkg/composer/october/system for details.

Is october/system deprecated?

No, october/system is actively maintained. Latest release: v1.1.12 (2022-02-20).

What are alternatives to october/system?

DepScope has no curated alternatives for october/system at this time.

What license does october/system use?

october/system is licensed under MIT.

october/system

composervv1.1.12

System module for October CMS

License MITpermissive169 versions2 maintainers2 deps

octoberrain/system

/ 100

Health

use with caution

october/[email protected] low health (33/100) — consider alternatives

Update to >= 4.0.12 to fix known vulnerabilities

Low health score (33/100)

Health breakdown0 – 100

0/25

maintenance

0/20

popularity

15/25

security

15/15

maturity

3/15

community

Vulnerabilities

5 medium3 low

Advisories (8)

Severity	ID	Summary	Fixed in
medium	CVE-2026-26067	October CMS has Safe Mode Bypass via CSS Preprocessor Compilers	4.1.10
medium	CVE-2026-24906	October CMS has Stored XSS in Backend Editor Markup Classes	3.7.14
low	CVE-2024-51991	October CMS Allows Unprotected SVG Rename in Media Manager	3.7.5
medium	CVE-2025-61674	October CMS Vulnerable to Stored XSS via Editor and Branding Styles	4.0.12
medium	CVE-2026-24907	October CMS has Stored XSS in Event Log Mail Preview	3.7.14
low	CVE-2026-27937	October CMS: Reflected XSS via DataTable Form Widget	3.7.16
low	CVE-2026-29179	October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations	3.7.16
medium	CVE-2025-61676	October CMS Vulnerable to Stored XSS via Branding Styles	4.0.12

Health History

Dependency Tree

License Audit

Dependencies (2)

php composer/installers

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/composer/october/system

Last updated · 2022-02-20T01:54:45+00:00