Executive brief
October CMS's backend widget storage mechanism used PHP serialization to persist widget state (search filters, sort settings, etc.) without proper security controls. An attacker with markup editing access in a Safe Mode installation could inject malicious serialized objects that execute arbitrary PHP code when the widget is next rendered. This only affects installations with Safe Mode enabled, a niche opt-in feature for shared or demo environments.
Technical details
The `Backend\Traits\SessionMaker` class stored widget session state as base64-encoded serialized PHP objects and deserialized them using `unserialize()` without setting the `allowed_classes => false` restriction, enabling object injection attacks. The vulnerability requires two conditions: (1) the target installation must have `cms.safe_mode` enabled (an opt-in feature primarily for demo/multi-tenant scenarios), and (2) the attacker must have backend user access with CMS markup editing privileges. Standard backend code paths wrap user input in known array structures before serialization, but an attacker with direct session-write access could craft malicious payloads. Exploitation also depends on the availability of a suitable PHP gadget chain in the installed dependency set. The patch replaces serialization with JSON for new writes and adds `allowed_classes => false` to the legacy deserialization fallback path, eliminating the injection vector.
Affected products
- October CMS october/system < 3.7.17, >= 4.0.0 < 4.2.23
Timeline
- 2026-09-13: disclosed
- 2026-09-13: patched: Patched in v3.7.17 and v4.2.23
References
- https://api.github.com/users/EndlssNightmare
- https://github.com/EndlssNightmare
- https://api.github.com/users/EndlssNightmare/gists%7B/gist_id%7D
- https://api.github.com/users/EndlssNightmare/repos
- https://avatars.githubusercontent.com/u/110058202?v=4
- https://api.github.com/users/EndlssNightmare/events%7B/privacy%7D