Media

October Rain has a Twig Sandbox Bypass via Collection Methods

Publicada: 14.04.2026
Actualizado: 11.10.2026 10:22

A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.

Impact

Bypass of Twig sandbox restrictions
Only affects installations with CMS_SAFE_MODE enabled (disabled by default)
Requires authenticated backend access with CMS template editing permissions

Patches

The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.

Workarounds

If upgrading immediately is not possible:

Disable CMS_SAFE_MODE if untrusted template editing is not required
Restrict CMS template editing permissions to fully trusted administrators only

References

Reported by Łukasz Rybak

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Paquete de Composer	october/rain	>= 4.0.0, < 4.1.5, < 3.7.13	4.1.5, 3.7.13

Referencias

Puntuación CVSS 4.9/10

Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Debilidad (CWE): CWE-284, CWE-693
Plataforma: Composer
Paquete: october/rain
Publicada: 14.04.2026
Actualizado: 11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-m5qg-jc75-4jp6 - CC BY 4.0

Historial de vulnerabilidades: october/rain

Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Entradas en total: 6
Primera → última: 08.2020 04.2026
Sin corrección: 0
Explotada en ataques: 0

Distribución por gravedad

Crítica 1
Media 5

Divulgaciones por año

2020: 1
2021: 1
2022: 1
2023: 0
2024: 0
2025: 0
2026: 3

14.04.2026

October Rain has Stored XSS via SVG Filter Bypass

Media · 4.8 CVE-2026-25133 >= 4.0.0, < 4.1.10, < 3.7.14 4.1.10, 3.7.14
14.04.2026

October Rain has Environment Variable Exfiltration via INI Parser Interpolation

Media · 4.9 CVE-2026-25125 >= 4.0.0, < 4.1.10, < 3.7.14 4.1.10, 3.7.14
14.04.2026

October Rain has a Twig Sandbox Bypass via Collection Methods esta entrada

Media · 4.9 CVE-2026-22692 >= 4.0.0, < 4.1.5, < 3.7.13 4.1.5, 3.7.13
13.05.2022

OctoberCMS Cross-Site Scripting

Media · 5.4 CVE-2017-15284 < 1.0.426 1.0.426
10.02.2021

October CMS Session ID not invalidated after logout

Crítica · 9.8 CVE-2021-3311 < 1.0.472, >= 1.1.0, < 1.1.2 1.0.472, 1.1.2
05.08.2020

Reliance on Cookies without validation in OctoberCMS

Media · 6.1 CVE-2020-15128 >= 1.0.319, < 1.0.468 1.0.468

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación