Is CVE-2026-22692 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-22692 being exploited in the wild.

How severe is CVE-2026-22692?

Medium severity, with a CVSS score of 4.9, published 14 April 2026.

Which products and versions are affected?

October CMS >= 4.0.0, <= 4.1.4; <= 3.7.12; october/rain (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=4.1.5.

Is there a fix for CVE-2026-22692?

Yes. october/rain (Packagist): upgrade to 4.1.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-22692 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-22692?

Check whether you run October CMS, Octobercms October or october/rain (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22692: October CMS October Rain Twig sandbox bypass via collection methods

Q: Is there a fix for CVE-2026-22692?

Yes. october/rain (Packagist): upgrade to 4.1.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-22692 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-22692?

Check whether you run October CMS, Octobercms October or october/rain (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22692 · Severity: medium · CVSS 4.9 · Published 2026-04-14

October CMS is a content management system used to build and manage websites. A security flaw was found in its template engine's "safe mode," which is intended to restrict what certain users can do. If exploited, an authorized user with permission to edit templates could bypass these security restrictions to access sensitive data or perform unauthorized actions.

Technologies: October CMS, Octobercms October, october/rain (Packagist). Vendors: October CMS, Octobercms, Packagist.

Quick answers

Is CVE-2026-22692 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-22692 being exploited in the wild.
How severe is CVE-2026-22692?: Medium severity, with a CVSS score of 4.9, published 14 April 2026.
Which products and versions are affected?: October CMS >= 4.0.0, <= 4.1.4; <= 3.7.12; october/rain (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=4.1.5.
Is there a fix for CVE-2026-22692?: Yes. october/rain (Packagist): upgrade to 4.1.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22692 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-22692?: Check whether you run October CMS, Octobercms October or october/rain (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

october/rain (Packagist): upgrade to 4.1.5 or later
```
composer require october/rain:^4.1.5
```

Technical details

A sandbox bypass vulnerability exists in the October Rain library's Twig safe mode feature (CMS_SAFE_MODE). The root cause is improper restriction of certain methods on the collect() helper, which allows authenticated backend users with CMS template editing permissions to execute code outside the intended sandbox boundaries. This vulnerability only impacts installations where CMS_SAFE_MODE is explicitly enabled, as it is disabled by default. Attackers can leverage this to gain unauthorized access to data or system resources. The issue has been patched in versions 4.1.5 and 3.7.13.

Affected products

October CMS Rain >= 4.0.0, <= 4.1.4; <= 3.7.12

Identifiers

CVE-2026-22692
GHSA-m5qg-jc75-4jp6

Timeline

2026-04-14: disclosed
2026-04-14: advisory
2026-04-14: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.