EUVD-2026-22357
GHSA-m5qg-jc75-4jp6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as privileged user
-
DeliveryAccess template editor
-
ExploitCraft template with unrestricted collect() calls
-
ExecutionBypass Twig sandbox enforcer
-
PersistAccess restricted data or functions
-
ImpactExfiltrate sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Impact | CVSS 4.9 (Medium) with High privileges required (PR:H) and confidentiality impact (C:H) indicates this is a privilege-escalation issue requiring admin-level backend access. The attack vector is Network (AV:N) and complexity is Low (AC:L), meaning no special network conditions are needed. CVSS scope is Unchanged (S:U), limiting impact to the affected resource. The real-world risk is moderate: while this affects only installations with the optional CMS_SAFE_MODE enabled, it directly undermines that feature's intended security boundary. Authenticated template editors with sandbox bypass can access sensitive data or system functionality that the safe mode was designed to protect. However, the requirement for authenticated backend access with high-level permissions (template editing) restricts the attack surface to trusted or compromised administrator accounts. This is a targeted privilege-abuse vector rather than an entry-point vulnerability. |
| Exploit ScenarioDerived | An authenticated October CMS backend user with template editing permissions could craft a malicious template that calls restricted collect() helper methods, bypassing the Twig safe mode sandbox. This could allow exfiltration of sensitive configuration data, database credentials, or other protected system information that the sandbox was designed to prevent untrusted template editors from accessing. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 14, 2026
Sandbox bypass in October CMS versions prior to 3.7.13 and 4.0.0-4.1.4 allows authenticated users with template editing permissions to bypass the optional Twig safe mode (CMS_SAFE_MODE) protections via unrestricted collect() helper methods. Exploitation requires authenticated backend access with CMS template editing permissions and only affects installations with the non-default CMS_SAFE_MODE feature enabled. Fixed in versions 3.7.13 and 4.1.5.
RemediationAI
Upgrade to October CMS version 3.7.13 or later (for the 3.x branch) or to version 4.1.5 or later (for the 4.x branch). For systems that cannot be immediately patched, disable CMS_SAFE_MODE if untrusted template editing is not required, and restrict CMS template editing permissions to only fully trusted administrators. Refer to the vendor security advisory at https://github.com/octobercms/october/security/advisories/GHSA-m5qg-jc75-4jp6 for detailed guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
October CMS is a Laravel-based content management system that optionally supports Twig safe mode via the CMS_SAFE_MODE configuration flag, designed to restrict template functionality for untrusted editors. The vulnerability exists in CMS_SAFE_MODE's sandbox implementation where certain methods on the collect() helper function were not properly restricted by the sandbox enforcer (CWE-693: Improper Restriction of Rendered UI Layers or Frames). This allows authenticated users with template editing permissions to invoke unrestricted methods that escape the intended sandbox boundary. The issue only manifests when CMS_SAFE_MODE is explicitly enabled; by default, this protection is disabled.
Know when October gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections. Exploitation requires authenticated backend access with CMS template editing permissions and only affects installations with CMS_SAFE_MODE enabled (disabled by default). This issue has been fixed in versions 3.7.13 and 4.1.5. To workaround this issue, users can disable CMS_SAFE_MODE if untrusted template editing is not required, and restrict CMS template editing permissions to fully trusted administrators only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise
An issue was discovered in October through build 471. Rated critical severity (CVSS 9.8), this vulnerability is remotely
octobercms in a CMS platform based on the Laravel PHP Framework. Rated critical severity (CVSS 9.1), this vulnerability
Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for po
Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Rated high severity (CVSS 7.2), this vulner
October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page. Rated medium severity (CVSS 6.1), this vu
October CMS build 412 is vulnerable to PHP code execution in the asset manager functionality resulting in site compromis
October CMS build 412 is vulnerable to file path modification in asset move functionality resulting in creating creating
October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site
Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG fil
Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrar
A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary w
Exploit-DB