漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
October: Safe Mode Bypass via CSS Preprocessor Compilers
Vulnerability Description
October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft .less, .sass, or .scss files that leverage the compiler's import functionality to read arbitrary files from the server. This worked even with cms.safe_mode enabled. This vulnerability is fixed in 3.7.14 and 4.1.10.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Vulnerability Type
授权机制不正确
Vulnerability Title
October 安全漏洞
Vulnerability Description
October是October开源的一个内容管理系统 (CMS) 和网络平台。 October 3.7.14之前版本和4.1.10之前版本存在安全漏洞，该漏洞源于CSS预处理器文件处理不当，可能导致具有Editor权限的后端用户读取服务器任意文件。
CVSS Information
N/A
Vulnerability Type
N/A