CVE-2026-26274 October: Safe Mode Bypass via Twig Database Write Operations
Backend users with Developer permissions can bypass Safe Mode to modify database tables via Twig templates in October CMS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-26274?
CVE-2026-26274 is a medium-severity vulnerability in octobercms october, published on 21 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a vulnerability was identified in the Twig sandbox security policy that allowed database write operations when cms.safe_mode is enabled. Backend users with Developer permissions could use Twig template markup to execute insert, update, and delete operations on any database table through the query builder, which is included in the sandbox allow-list. This vulnerability is fixed in 3.7.14 and 4.1.10.
Which versions are affected by CVE-2026-26274?
4 open source packages ship an affected version, including october/october.
| Package | Affected | Fixed in |
|---|---|---|
october/october Packagist | All versions | 3.7.14 |
october/october Packagist | All versions | 3.7.14 |
october/october Packagist | From 4.0.0 | 4.1.10 |
october/october Packagist | From 4.0.0 | 4.1.10 |
How do I fix CVE-2026-26274?
Upgrade october/october to a fixed version for your release line: 3.7.14 or 4.1.10.
Is CVE-2026-26274 being exploited?
There is no known exploitation of CVE-2026-26274 in the wild and no public exploit code.
Sources
Also known as GHSA-h6jm-f4hh-fw27.