Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
October CMS (october/backend package) versions before 1.1.2 are vulnerable to Host Header Poisoning when the web server accepts any hostname and routes all requests to the October CMS instance. The source does not state what access an attacker needs beyond this server configuration. Upgrade to version 1.1.2, which adds a list of trusted hosts; if upgrading is not possible, check that the cms.linkPolicy setting is set to force and confirm your web server only accepts known hostnames.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 6.8 | Medium | 3.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.017, the 77th percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:25 UTC First seen by agentprime
- 31 Oct 2026, 14:25 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-xhfx-hgmf-v6vp
- OSV: GHSA-xhfx-hgmf-v6vp
- github.com/octobercms/october/security/advisories/GHSA-xhfx-hgmf-v6vp
- nvd.nist.gov/vuln/detail/CVE-2021-21265
- github.com/octobercms/library/commit/f29865ae3db7a03be7c49294cd93980ec457f10d
- github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6
- github.com/octobercms/october/commit/555ab61f2313f45d7d5d138656420ead536c5d30
- github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0
- packagist.org/packages/october/backend