CVE-2026-49400: October CMS PHP object injection in widget session storage

CVE-2026-49400 · Severity: low · CVSS 3.3 · Published 2026-09-14

October CMS's backend widget storage mechanism used PHP serialization to persist widget state (search filters, sort settings, etc.) without proper security controls. An attacker with markup editing access in a Safe Mode installation could inject malicious serialized objects that execute arbitrary PHP code when the widget is next rendered. This only affects installations with Safe Mode enabled, a niche opt-in feature for shared or demo environments.

Technologies: october/system (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-49400 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49400 being exploited in the wild.
How severe is CVE-2026-49400?
Low severity, with a CVSS score of 3.3, published 14 September 2026.
Which products and versions are affected?
october/system (Packagist) ECOSYSTEM:introduced=0,fixed=3.7.17.
Is there a fix for CVE-2026-49400?
Yes. october/system (Packagist): upgrade to 3.7.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49400 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-49400?
Check whether you run october/system (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • october/system (Packagist): upgrade to 3.7.17 or later
    composer require october/system:^3.7.17

Technical details

The `Backend\Traits\SessionMaker` class stored widget session state as base64-encoded serialized PHP objects and deserialized them using `unserialize()` without setting the `allowed_classes => false` restriction, enabling object injection attacks. The vulnerability requires two conditions: (1) the target installation must have `cms.safe_mode` enabled (an opt-in feature primarily for demo/multi-tenant scenarios), and (2) the attacker must have backend user access with CMS markup editing privileges. Standard backend code paths wrap user input in known array structures before serialization, but an attacker with direct session-write access could craft malicious payloads. Exploitation also depends on the availability of a suitable PHP gadget chain in the installed dependency set. The patch replaces serialization with JSON for new writes and adds `allowed_classes => false` to the legacy deserialization fallback path, eliminating the injection vector.

Affected products

  • October CMS october/system < 3.7.17, >= 4.0.0 < 4.2.23

Identifiers

  • CVE-2026-49400
  • GHSA-2ff2-mx52-q8wp

Timeline

  • 2026-09-13: disclosed
  • 2026-09-13: patched: Patched in v3.7.17 and v4.2.23

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.