CVE-2026-22692: October CMS October Rain Twig sandbox bypass via collection methods

Executive brief

October CMS is a content management system used to build and manage websites. A security flaw was found in its template engine's "safe mode," which is intended to restrict what certain users can do. If exploited, an authorized user with permission to edit templates could bypass these security restrictions to access sensitive data or perform unauthorized actions.

Technical details

A sandbox bypass vulnerability exists in the October Rain library's Twig safe mode feature (CMS_SAFE_MODE). The root cause is improper restriction of certain methods on the collect() helper, which allows authenticated backend users with CMS template editing permissions to execute code outside the intended sandbox boundaries. This vulnerability only impacts installations where CMS_SAFE_MODE is explicitly enabled, as it is disabled by default. Attackers can leverage this to gain unauthorized access to data or system resources. The issue has been patched in versions 4.1.5 and 3.7.13.

Affected products

• October CMS Rain >= 4.0.0, <= 4.1.4; <= 3.7.12

Timeline

• 2026-04-14: disclosed
• 2026-04-14: advisory
• 2026-04-14: patched

References

• https://api.github.com/users/lukasz-rybak
• https://github.com/lukasz-rybak
• https://api.github.com/users/lukasz-rybak/gists%7B/gist_id%7D
• https://api.github.com/users/lukasz-rybak/repos
• https://avatars.githubusercontent.com/u/185241918?v=4
• https://api.github.com/users/lukasz-rybak/events%7B/privacy%7D