CVE-2026-22692
Sandbox Bypass in October CMS Twig Safe Mode Allows Escalation
Publication date: 2026-04-14
Last updated on: 2026-04-21
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| octobercms | october | to 3.7.13 (exc) |
| octobercms | october | From 4.0.0 (inc) to 4.1.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
| CWE-693 | The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability affects October CMS installations with the CMS_SAFE_MODE enabled and requires authenticated backend access with template editing permissions. Detection involves verifying the CMS version and configuration settings.
- Check the October CMS version to see if it is prior to 3.7.13 or between 4.0.0 and 4.1.4, which are vulnerable versions.
- Verify if CMS_SAFE_MODE is enabled, since the vulnerability only affects installations with this feature active.
- Confirm which users have backend template editing permissions, as exploitation requires authenticated users with these rights.
Specific commands are not provided in the resources, but typical commands might include checking the application version and configuration files, for example:
- Use a command or script to query the October CMS version, such as inspecting the composer.lock file or running October CMS CLI commands if available.
- Inspect configuration files or environment variables to determine if CMS_SAFE_MODE is enabled.
- Audit user permissions in the backend to identify users with template editing rights.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, users should upgrade October CMS to versions 3.7.13 or 4.1.5 where the issue is fixed.
If upgrading is not immediately possible, the following workarounds are recommended:
- Disable the CMS_SAFE_MODE feature if untrusted template editing is not required, as it is disabled by default and the vulnerability only affects installations with it enabled.
- Restrict CMS template editing permissions strictly to fully trusted administrators to reduce the risk of exploitation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows authenticated users with template editing permissions to bypass sandbox protections, potentially exposing sensitive data due to a high confidentiality impact.
Exposure of sensitive data can lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require strict controls to protect personal and health information confidentiality.
Therefore, if exploited, this vulnerability could result in violations of these standards by compromising the confidentiality of protected data.
Can you explain this vulnerability to me?
CVE-2026-22692 is a vulnerability in the October CMS's Twig safe mode feature (CMS_SAFE_MODE). It is a sandbox bypass issue caused by insufficient restrictions on certain methods of the collect() helper used in Twig templates.
This flaw allows authenticated users who have backend template editing permissions to bypass sandbox protections that are supposed to restrict what templates can do.
The vulnerability only affects installations where CMS_SAFE_MODE is enabled (which is disabled by default) and requires the attacker to have authenticated backend access with template editing rights.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an authenticated user with template editing permissions to bypass sandbox protections and potentially access sensitive data.
The confidentiality impact is high, meaning sensitive or confidential information could be exposed.
However, the vulnerability does not affect data integrity or availability.
Exploitation requires high privileges (authenticated backend access with template editing rights) and only affects systems with CMS_SAFE_MODE enabled.