Executive brief
October CMS contains a vulnerability in its Safe Mode sandbox feature that allows a backend editor with markup-editing permissions to bypass security restrictions. An attacker could read sensitive database data (including superuser credentials) and forge backend authentication sessions to impersonate administrators. This only affects installations where Safe Mode is explicitly enabled—a deliberate opt-in for demo or multi-tenant scenarios where untrusted users have editor access.
Technical details
The vulnerability is a chained sandbox bypass in October CMS's Twig sandbox when `cms.safe_mode` is enabled. The Laravel session store was exposed to Twig with unrestricted method access, and raw SQL methods (selectRaw, whereRaw, orderByRaw, joinSub) reachable through Eloquent's `__call` forwarding were not blocked across the full builder chain. A backend user with CMS markup editing permissions could chain these to read arbitrary database tables via raw SQL expressions and write to the `admin_auth` session key to forge a backend session. Attack requires: (1) `cms.safe_mode` enabled, (2) authenticated backend access with markup editing permission, (3) at least one existing superuser account. The fix patches v3.7.17 and v4.2.23+ by wrapping the session store in a proxy with restricted method access and blocking raw SQL methods on Query\Builder, Eloquent\Builder, and Eloquent\Model.
Affected products
- October CMS October CMS < 3.7.17; >= 4.0.0, < 4.2.23
Timeline
- 2026-09-14: disclosed: Vulnerability published by GitHub Advisory Database
- 2026-09-14: patched: Patches released in v3.7.17 and v4.2.23