# CVE-2026-22692: October CMS October Rain Twig sandbox bypass via collection methods

Source: https://junglewise.ai/threats/cve-2026-22692-october-cms-october-rain-twig-sandbox-bypass-via-collection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-14. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-22692 · Severity: medium · CVSS 4.9 · Published 2026-04-14

October CMS is a content management system used to build and manage websites. A security flaw was found in its template engine's "safe mode," which is intended to restrict what certain users can do. If exploited, an authorized user with permission to edit templates could bypass these security restrictions to access sensitive data or perform unauthorized actions.

Technologies: [October CMS](https://junglewise.ai/threats/technologies/october-cms), [Octobercms October](https://junglewise.ai/threats/technologies/october), [october/rain (Packagist)](https://junglewise.ai/threats/technologies/october-rain). Vendors: [October CMS](https://junglewise.ai/threats/vendors/october-cms), [Octobercms](https://junglewise.ai/threats/vendors/octobercms), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-22692 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-22692 being exploited in the wild.

**How severe is CVE-2026-22692?** Medium severity, with a CVSS score of 4.9, published 14 April 2026.

**Which products and versions are affected?** October CMS >= 4.0.0, <= 4.1.4; <= 3.7.12; october/rain (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=4.1.5.

**Is there a fix for CVE-2026-22692?** Yes. october/rain (Packagist): upgrade to 4.1.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-22692 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-22692?** Check whether you run October CMS, Octobercms October or october/rain (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- october/rain (Packagist): upgrade to 4.1.5 or later

  ```sh
  composer require october/rain:^4.1.5
  ```


## Technical details

A sandbox bypass vulnerability exists in the October Rain library's Twig safe mode feature (CMS_SAFE_MODE). The root cause is improper restriction of certain methods on the collect() helper, which allows authenticated backend users with CMS template editing permissions to execute code outside the intended sandbox boundaries. This vulnerability only impacts installations where CMS_SAFE_MODE is explicitly enabled, as it is disabled by default. Attackers can leverage this to gain unauthorized access to data or system resources. The issue has been patched in versions 4.1.5 and 3.7.13.

## Affected products

- October CMS Rain >= 4.0.0, <= 4.1.4; <= 3.7.12

## Identifiers

- CVE-2026-22692
- GHSA-m5qg-jc75-4jp6

## Timeline

- 2026-04-14: disclosed
- 2026-04-14: advisory
- 2026-04-14: patched

## References

- [https://api.github.com/users/lukasz-rybak](https://api.github.com/users/lukasz-rybak)
- [https://github.com/lukasz-rybak](https://github.com/lukasz-rybak)
- [https://api.github.com/users/lukasz-rybak/gists%7B/gist_id%7D](https://api.github.com/users/lukasz-rybak/gists%7B/gist_id%7D)
- [https://api.github.com/users/lukasz-rybak/repos](https://api.github.com/users/lukasz-rybak/repos)
- [https://avatars.githubusercontent.com/u/185241918?v=4](https://avatars.githubusercontent.com/u/185241918?v=4)
- [https://api.github.com/users/lukasz-rybak/events%7B/privacy%7D](https://api.github.com/users/lukasz-rybak/events%7B/privacy%7D)

## Related threats

- [October CMS stored XSS in SVG sanitization logic](https://junglewise.ai/threats/cve-2026-25133-october-cms-stored-xss-in-svg-sanitization-logic)
- [October CMS information disclosure in INI settings parser](https://junglewise.ai/threats/cve-2026-25125-october-cms-information-disclosure-in-ini-settings-parser)
- [October CMS has Stored XSS in Event Log Mail Preview](https://junglewise.ai/threats/cve-2026-24907-october-cms-has-stored-xss-in-event-log-mail-preview)
- [October CMS has Stored XSS in Backend Editor Markup Classes](https://junglewise.ai/threats/cve-2026-24906-october-cms-has-stored-xss-in-backend-editor-markup-classes)
- [OctoberCMS Cross-Site Scripting](https://junglewise.ai/threats/cve-2017-15284-octobercms-cross-site-scripting)