CVE-2026-22692
October CMS: Twig Sandbox Bypass via Collection Methods
Description
October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections. Exploitation requires authenticated backend access with CMS template editing permissions and only affects installations with CMS_SAFE_MODE enabled (disabled by default). This issue has been fixed in versions 3.7.13 and 4.1.5. To workaround this issue, users can disable CMS_SAFE_MODE if untrusted template editing is not required, and restrict CMS template editing permissions to fully trusted administrators only.
INFO
Published Date :
April 14, 2026, 5:16 p.m.
Last Modified :
Oct. 26, 2026, 10:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update October CMS to version 3.7.13 or 4.1.5.
- Disable CMS_SAFE_MODE if template editing is not required.
- Restrict template editing permissions to trusted administrators.
Public PoC/Exploit Available at Github
CVE-2026-22692 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-22692.
| URL | Resource |
|---|---|
| https://github.com/octobercms/october/security/advisories/GHSA-m5qg-jc75-4jp6 | Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-22692 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-22692
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
CVE-2026-22692 - Critical Twig Sandbox Bypass via collect()->mapInto() allowing RCE/LFI/XXE in October CMS
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-22692 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-22692 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 26, 2026
Action Type Old Value New Value Added Translation Title: october de octobercms, Description: October es un Sistema de Gestión de Contenidos (CMS) y plataforma web. Las versiones anteriores a la 3.7.13 y las versiones 4.0.0 a la 4.1.4 contienen una vulnerabilidad de bypass de sandbox en la característica opcional de modo seguro de Twig (CMS_SAFE_MODE). Ciertos métodos en el ayudante collect() no estaban correctamente restringidos, permitiendo a usuarios autenticados con permisos de edición de plantillas saltarse las protecciones de sandbox. La explotación requiere acceso autenticado al backend con permisos de edición de plantillas de CMS y solo afecta a instalaciones con CMS_SAFE_MODE habilitado (deshabilitado por defecto). Este problema ha sido solucionado en las versiones 3.7.13 y 4.1.5. Para aplicar una solución alternativa a este problema, los usuarios pueden deshabilitar CMS_SAFE_MODE si no se requiere la edición de plantillas no confiables, y restringir los permisos de edición de plantillas de CMS solo a administradores de plena confianza. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'octobercms', 'product': 'october', 'versions': [{'status': 'affected', 'version': '< 3.7.13'}, {'status': 'affected', 'version': '>= 4.0.0, < 4.1.5'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-22692', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-04-14T19:42:23.040347Z'} -
Initial Analysis by [email protected]
Apr. 21, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N Added CPE Configuration OR *cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:* versions up to (excluding) 3.7.13 *cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:* versions from (including) 4.0.0 up to (excluding) 4.1.5 Added Reference Type GitHub, Inc.: https://github.com/octobercms/october/security/advisories/GHSA-m5qg-jc75-4jp6 Types: Vendor Advisory -
New CVE Received by [email protected]
Apr. 14, 2026
Action Type Old Value New Value Added Description October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections. Exploitation requires authenticated backend access with CMS template editing permissions and only affects installations with CMS_SAFE_MODE enabled (disabled by default). This issue has been fixed in versions 3.7.13 and 4.1.5. To workaround this issue, users can disable CMS_SAFE_MODE if untrusted template editing is not required, and restrict CMS template editing permissions to fully trusted administrators only. Added CVSS V3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N Added CWE CWE-284 Added CWE CWE-693 Added Reference https://github.com/octobercms/october/security/advisories/GHSA-m5qg-jc75-4jp6