Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-22692: October CMS can let template editors bypass sandbox

CVE-2026-22692 · published 6 months ago

Summary

Versions of October CMS before 3.7.13 and between 4.0.0 and 4.1.4 let users who can edit templates escape the built‑in safety filter when the optional safe mode is turned on. This could let a trusted‑looking user run code they shouldn’t be able to. Update to the latest version or turn off safe mode and limit template‑editing rights to trusted administrators.

What to do

Update october rain to version 4.1.5.
Update october rain to version 3.7.13.

Affected software

Ecosystem	Vendor	Product	Affected versions
composer	october	rain	>= 4.0.0, <= 4.1.4 <= 3.7.12 Fix: upgrade to 4.1.5
–	octobercms	october	< 3.7.13 >= 4.0.0, < 4.1.5 `cpe:2.3:a:octobercms:october::::::::`

Original advisory text

October CMS: Twig Sandbox Bypass via Collection Methods

October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections. Exploitation requires authenticated backend access with CMS template editing permissions and only affects installations with CMS_SAFE_MODE enabled (disabled by default). This issue has been fixed in versions 3.7.13 and 4.1.5. To workaround this issue, users can disable CMS_SAFE_MODE if untrusted template editing is not required, and restrict CMS template editing permissions to fully trusted administrators only.

References

https://github.com/advisories/GHSA-m5qg-jc75-4jp6
https://github.com/octobercms/october/security/advisories/GHSA-m5qg-jc75-4jp6 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-22692 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22692... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.8 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-284Improper Access Control

CWE-693Protection Mechanism Failure

Timeline

Published14 Apr 2026

Updated4 Nov 2026

First seen14 Apr 2026

Sources

CVE-2026-22692 · NVD

GHSA-m5qg-jc75-4jp6 · GHSA

CVE-2026-22692 · OSV

Track software like this

Free during beta