CVE-2026-46696
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A vulnerability in the October CMS system module's Twig sandbox security policy allowed a chained bypass when cms.safe_mode is enabled. By combining unrestricted access to the Laravel session store with unblocked raw SQL methods reachable through Eloquent's __call forwarding, a backend user with CMS markup editing access could read arbitrary database values and write to the backend authentication session key, forging a session as another existing user. The issue is patched in versions 3.7.17 and 4.2.21.
Risk Assessment
The risk applies only to sites with cms.safe_mode enabled where an untrusted user has CMS markup editing access and at least one superuser account exists. In that configuration, an attacker can impersonate another user's session and read arbitrary database values. Standard production deployments do not enable Safe Mode, so their exposure is negligible.
Recommendation
Upgrade October CMS to version 3.7.17 or 4.2.21 (or later). If upgrading is not possible, restrict CMS markup editing access to fully trusted administrators only; do not disable cms.safe_mode as a workaround, as Safe Mode is the security boundary affected by this issue.
Other vulnerabilities in October CMS
See all- CVE-2026-101005High
A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely, and the exploit is now public.
- CVE-2017-16941High
October CMS through 1.0.428 does not prevent the use of .htaccess in themes, allowing remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a .htaccess file.
- CVE-2017-1000195High
October CMS version 412 is vulnerable to PHP object injection in asset move functionality, allowing for the deletion of files limited by file permissions on the server.
- CVE-2017-1000119High
October CMS version 412 is vulnerable to PHP code execution in the file upload functionality, potentially leading to site compromise and possibly affecting other applications on the server.
- CVE-2021-32648HighActively exploited
A vulnerability in the october/system package of October CMS allows an attacker to request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.
- CVE-2017-1000197Critical
October CMS version 412 is vulnerable to file path modification in asset move functionality, potentially allowing the creation of malicious files on the server.
- CVE-2017-1000196Critical
October CMS version 412 is vulnerable to PHP code execution in the asset manager functionality, potentially leading to site compromise and possibly affecting other applications on the server.
- CVE-2017-1000194Critical
October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality, potentially leading to site compromise and affecting other applications on the server.
- CVE-2026-49400Low
October CMS versions prior to 3.7.17 and 4.2.21 contain a PHP object injection vulnerability in the system module. The backend `SessionMaker` trait stored widget session state as `base64(serialize(...))` and consumed it with `unserialize()` without an `allowed_classes` restriction, allowing attacker-controlled bytes to trigger object injection and reachable PHP gadget chains. This issue only affects installations with `cms.safe_mode` enabled, which is an opt-in feature for demo or multi-tenant scenarios.
- CVE-2026-29179Low
In October CMS prior to 3.7.16 and 4.1.16, fine-grained sub-permission checks for asset and blueprint file operations were not enforced in the CMS and Tailor editor extensions. Backend users granted editor access but explicitly denied editor.cms_assets or editor.tailor_blueprints could still create, delete, rename, move, and upload files. A related operator precedence error in Tailor navigation also disclosed the theme blueprint directory tree.
Original NVD description (English source)
October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security policy that allowed a chained bypass when `cms.safe_mode` is enabled. The Laravel session store was exposed to Twig with unrestricted method access, and raw SQL methods reachable through Eloquent's `__call` forwarding were not blocked across the full builder chain. When combined, a backend user with CMS markup editing access could read arbitrary database values via raw SQL expressions and write to the backend authentication session key, forging a backend session as another existing user. The scope of impact is narrow. Safe Mode is a niche feature, primarily used for demo installations and multi-tenant or shared-editor scenarios where untrusted users are deliberately granted access to the CMS markup editor. Standard production deployments do not enable Safe Mode, because under normal October CMS guidance backend access - including markup editing - is restricted to trusted administrators, and direct PHP injection through markup is already possible without Safe Mode in that configuration. This issue only affects sites that meet all of the following conditions: `cms.safe_mode` is enabled (a deliberate opt-in for demos or untrusted-editor scenarios; the site has at least one backend user with CMS markup editing access who is not intended to be trusted as a full administrator; and the site has at least one existing superuser account whose session the lower-privileged user can impersonate. The vulnerability has been patched in v3.7.17 and v4.2.21. The Laravel session store is now wrapped in a proxy that exposes only an explicit subset of read/write methods and rejects writes to reserved session key prefixes (`admin_auth`, `october_auth`, `login_*`, `_token`, and other framework internals). Raw SQL and subquery methods (`selectRaw`, `whereRaw`, `orderByRaw`, `joinSub`, and related) are now blocked on `Query\Builder`, `Eloquent\Builder`, and `Eloquent\Model` so the blocklist is consistent across the `__call` forwarding chain. All sites that enable `cms.safe_mode` are encouraged to upgrade to the latest patched version. A workaround is available. Restrict CMS markup editing access to fully trusted administrators only - the standard October CMS recommendation for any deployment. Note that disabling `cms.safe_mode` is not a workaround; Safe Mode is the boundary this issue affects, and disabling it removes the only sandbox between markup editors and the server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS