CVE-2020-5297: 
PHP vulnerability analysis and mitigation

CVE-2020-5297 affects OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466. The vulnerability allows an authenticated backend user with 'cms.manage_assets' permission to upload various file types (including jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, xml) to any directory on an October CMS server (GitHub Advisory).

The vulnerability exists in the functionality that lets a user with 'Manage website assets' permission to move assets from one folder to another. The issue stems from the onMove() function defined in modules/cms/widgets/AssetList.php:305, where the $destinationDir variable is initiated directly from the 'dest' parameter without proper validation. This allows moving files from the assets folder to any directory in the server (Full Disclosure).

An attacker with the required permissions can exploit this vulnerability to upload whitelisted file types to any directory on the October CMS server. This could potentially lead to security implications depending on the types of files uploaded and their locations (GitHub Advisory).

The vulnerability requires an authenticated backend user with the specific 'cms.manage_assets' permission to exploit. The attack can be executed by modifying the 'dest' parameter in the request sent to the server for moving an asset file (Full Disclosure).

The vulnerability has been patched in Build 466 (v1.0.466). For users unable to upgrade, they can manually apply the patch 6711dae to their installation, which improves asset file path handling when moving assets. The patch includes validation of the destination path to ensure it remains within the safe directory (GitHub Commit).