october/system (packagist) has 25 known vulnerabilities, the worst rated CRITICAL. No single fixed version is recorded that clears every advisory, so check each one below. No malicious-package signal is recorded.
An authenticated backend user with the editor.cmspages, editor.cmslayouts, or editor.cmspartials permissions who would normally not be permitted to provide PHP…
CyberXYZ does not call a package safe in absolute terms. It records 25 known vulnerabilities for october/system (packagist), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does october/system have known vulnerabilities?
Yes. CyberXYZ records 25 known vulnerabilities for october/system (packagist), the worst rated CRITICAL. These include GHSA-p8q3-h652-65vx, GHSA-x4q7-m6fp-4v9v, GHSA-8v7h-cpc2-r8jp, GHSA-79jw-2f46-wv22, GHSA-5hfj-r725-wpc4.
How do I check october/system before installing?
Search october/system in CyberXYZ Check at https://cyberxyz.io/check?q=october%2Fsystem. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 13:06 UTC. The most recent advisory here was published 2026-09-14. Updated continuously from NVD, GHSA, OSV and CNA feeds.