CVE-2017-16941

CVE-2017-16941 affects October CMS through version 1.0.428, allowing remote authenticated users with theme management access to execute arbitrary PHP code. This is achieved by uploading a malicious theme ZIP archive containing a PHP file and a .htaccess file that enables its execution. The vulnerability carries a CVSS score of 8.8 (HIGH), indicating a network-based attack with low complexity and requiring low privileges, leading to high impact on confidentiality, integrity, and availability. While the vendor disputes its threat model, there is no known active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.