CVE-2026-22692 October CMS: Twig Sandbox Bypass via Collection Methods
Authenticated users with template editing permissions can bypass Twig sandbox protections in October CMS when safe mode is enabled, potentially executing arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-22692?
CVE-2026-22692 is a medium-severity vulnerability in Octobercms October, published on 14 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections. Exploitation requires authenticated backend access with CMS template editing permissions and only affects installations with CMS_SAFE_MODE enabled (disabled by default). This issue has been fixed in versions 3.7.13 and 4.1.5. To workaround this issue, users can disable CMS_SAFE_MODE if untrusted template editing is not required, and restrict CMS template editing permissions to fully trusted administrators only.
Which versions are affected by CVE-2026-22692?
4 open source packages ship an affected version, including october/rain. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
october/rain Packagist | All versions | 3.7.13 |
october/rain Packagist | All versions | 3.7.13 |
october/rain Packagist | From 4.0.0 | 4.1.5 |
october/rain Packagist | From 4.0.0 | 4.1.5 |
Products include Octobercms October.
How do I fix CVE-2026-22692?
Upgrade october/rain to a fixed version for your release line: 3.7.13 or 4.1.5.
Is CVE-2026-22692 being exploited?
There is no known exploitation of CVE-2026-22692 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Octobercms October
Sources
Also known as GHSA-m5qg-jc75-4jp6.