CVE-2026-22692

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22692", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-08T19:23:09.855Z", "datePublished": "2026-04-14T16:48:04.730Z", "dateUpdated": "2026-04-14T19:42:40.460Z"}, "containers": {"cna": {"title": "October CMS: Twig Sandbox Bypass via Collection Methods", "problemTypes": [{"descriptions": [{"cweId": "CWE-693", "lang": "en", "description": "CWE-693: Protection Mechanism Failure", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/octobercms/october/security/advisories/GHSA-m5qg-jc75-4jp6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/octobercms/october/security/advisories/GHSA-m5qg-jc75-4jp6"}], "affected": [{"vendor": "octobercms", "product": "october", "versions": [{"version": "< 3.7.13", "status": "affected"}, {"version": ">= 4.0.0, < 4.1.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T16:48:04.730Z"}, "descriptions": [{"lang": "en", "value": "October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections. Exploitation requires authenticated backend access with CMS template editing permissions and only affects installations with CMS_SAFE_MODE enabled (disabled by default). This issue has been fixed in versions 3.7.13 and 4.1.5. To workaround this issue, users can disable CMS_SAFE_MODE if untrusted template editing is not required, and restrict CMS template editing permissions to fully trusted administrators only."}], "source": {"advisory": "GHSA-m5qg-jc75-4jp6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-14T19:42:23.040347Z", "id": "CVE-2026-22692", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T19:42:40.460Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22692", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T19:42:23.040347Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T19:42:33.502Z"}}], "cna": {"title": "October CMS: Twig Sandbox Bypass via Collection Methods", "source": {"advisory": "GHSA-m5qg-jc75-4jp6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "octobercms", "product": "october", "versions": [{"status": "affected", "version": "< 3.7.13"}, {"status": "affected", "version": ">= 4.0.0, < 4.1.5"}]}], "references": [{"url": "https://github.com/octobercms/october/security/advisories/GHSA-m5qg-jc75-4jp6", "name": "https://github.com/octobercms/october/security/advisories/GHSA-m5qg-jc75-4jp6", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections. Exploitation requires authenticated backend access with CMS template editing permissions and only affects installations with CMS_SAFE_MODE enabled (disabled by default). This issue has been fixed in versions 3.7.13 and 4.1.5. To workaround this issue, users can disable CMS_SAFE_MODE if untrusted template editing is not required, and restrict CMS template editing permissions to fully trusted administrators only."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "CWE-693: Protection Mechanism Failure"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T16:48:04.730Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22692", "state": "PUBLISHED", "dateUpdated": "2026-04-14T19:42:40.460Z", "dateReserved": "2026-01-08T19:23:09.855Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-14T16:48:04.730Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "october", "vendor": "octobercms", "versions": [{"status": "affected", "version": "< 3.7.13"}, {"status": "affected", "version": ">= 4.0.0, < 4.1.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*", "matchCriteriaId": "BD599F53-B664-4667-9A0A-D745EF8D777B", "versionEndExcluding": "3.7.13", "vulnerable": true}, {"criteria": "cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*", "matchCriteriaId": "7AA00A10-35F7-4084-AEE2-2DC6E2844E88", "versionEndExcluding": "4.1.5", "versionStartIncluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections. Exploitation requires authenticated backend access with CMS template editing permissions and only affects installations with CMS_SAFE_MODE enabled (disabled by default). This issue has been fixed in versions 3.7.13 and 4.1.5. To workaround this issue, users can disable CMS_SAFE_MODE if untrusted template editing is not required, and restrict CMS template editing permissions to fully trusted administrators only."}, {"lang": "es", "value": "October es un Sistema de Gesti\u00f3n de Contenidos (CMS) y plataforma web. Las versiones anteriores a la 3.7.13 y las versiones 4.0.0 a la 4.1.4 contienen una vulnerabilidad de bypass de sandbox en la caracter\u00edstica opcional de modo seguro de Twig (CMS_SAFE_MODE). Ciertos m\u00e9todos en el ayudante collect() no estaban correctamente restringidos, permitiendo a usuarios autenticados con permisos de edici\u00f3n de plantillas saltarse las protecciones de sandbox. La explotaci\u00f3n requiere acceso autenticado al backend con permisos de edici\u00f3n de plantillas de CMS y solo afecta a instalaciones con CMS_SAFE_MODE habilitado (deshabilitado por defecto). Este problema ha sido solucionado en las versiones 3.7.13 y 4.1.5. Para aplicar una soluci\u00f3n alternativa a este problema, los usuarios pueden deshabilitar CMS_SAFE_MODE si no se requiere la edici\u00f3n de plantillas no confiables, y restringir los permisos de edici\u00f3n de plantillas de CMS solo a administradores de plena confianza."}], "id": "CVE-2026-22692", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 4.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22692", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-14T19:42:23.040347Z", "version": "2.0.3"}}]}, "published": "2026-04-14T17:16:28.423", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/octobercms/october/security/advisories/GHSA-m5qg-jc75-4jp6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-693"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.7.13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.1.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "october", "source": "cna", "vendor": "octobercms"}, "product": "october", "vendor": "octobercms"}], "analysis": {"en": {"generated_at": "2026-04-14T18:23:52.175989+00:00", "value": {"mitigation_remediation": ["Upgrade to October CMS 3.7.13 or later, or 4.1.5 or later", "If an upgrade is not immediately possible, disable CMS_SAFE_MODE to eliminate the sandbox bypass vulnerability", "Restrict CMS template editing permissions to fully trusted administrators only", "Verify that no other installations with CMS_SAFE_MODE remain active"], "summary": {"action": "Patch Immediately", "impact": "Bypass of template sandbox allowing arbitrary template execution"}, "threat_synthesis": {"affected_systems": "October CMS versions prior to 3.7.13 and 4.0.0 through 4.1.4. The issue only impacts installations where the CMS_SAFE_MODE feature is enabled, which is disabled by default.", "description_and_impact": "The vulnerability arises from the optional Twig safe mode (CMS_SAFE_MODE) in October CMS. Certain methods on the collect() helper were not properly restricted, enabling authenticated users with template editing permissions to bypass sandbox protections. This bypass permits the execution of arbitrary code within Twig templates. The weakness is a failure to enforce proper access control (CWE\u2011284) and a protection failure (CWE\u2011693).", "risk_and_exploitability": "The CVSS score of 4.9 indicates moderate severity. Exploitation requires authenticated backend access with template editing permissions and the CMS_SAFE_MODE setting enabled. EPSS data is not available, and the vulnerability is not in the CISA KEV catalog. Attackers must first gain legitimate user credentials; there is no known unauthenticated vector, so the risk is moderate to high for organizations with admins who have template editing rights."}}}}, "created": "2026-04-15T14:31:56.928879+00:00", "updated": "2026-04-15T15:15:06.650753+00:00", "vendors": ["octobercms", "octobercms$PRODUCT$october"]}