Media

October CMS has Safe Mode Bypass via CSS Preprocessor Compilers

Publicada: 21.04.2026
Actualizado: 11.10.2026 10:22

A server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft .less, .sass, or .scss files that leverage the compiler's import functionality to read arbitrary files from the server. This worked even with cms.safe_mode enabled.

Impact

Potential exposure of sensitive server-side files
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)

Patches

The vulnerability has been patched in v3.7.14 and v4.1.10. When cms.safe_mode is enabled, .less, .sass, and .scss files can no longer be created, uploaded, or edited across the CMS editor, media manager, and file upload interfaces. All users are encouraged to upgrade to the latest patched version.

Workarounds

If upgrading immediately is not possible:

Set cms.editable_asset_types config to ['css', 'js'] to remove preprocessor file types from the editor
Restrict Editor tool access to fully trusted administrators only
Reported by Chris Alupului

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Paquete de Composer	october/system	< 3.7.14, >= 4.0.0, < 4.1.10	3.7.14, 4.1.10

Referencias

Puntuación CVSS 4.9/10

Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Debilidad (CWE): CWE-184, CWE-200, CWE-22
Plataforma: Composer
Paquete: october/system
Publicada: 21.04.2026
Actualizado: 11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-3888-q23f-x7qh - CC BY 4.0

Historial de vulnerabilidades: october/system

Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (25) en el archivo

Entradas en total: 25
Primera → última: 06.2020 09.2026
Sin corrección: 0
Explotada en ataques: 1

Distribución por gravedad

Crítica 1
Alta 8
Media 9
Baja 7

Divulgaciones por año

2020: 1
2021: 3
2022: 6
2023: 3
2024: 2
2025: 1
2026: 9

21.04.2026

October CMS has Safe Mode Bypass via CSS Preprocessor Compilers esta entrada

Media · 4.9 CVE-2026-26067 < 3.7.14, >= 4.0.0, < 4.1.10 3.7.14, 4.1.10
29.11.2023

October CMS safe mode bypass using Twig sandbox escape

Crítica · 9.1 CVE-2023-44382 >= 3.0.0, < 3.4.15 3.4.15
13.10.2022

October CMS Safe Mode bypass leads to authenticated Remote Code Execution

Alta · 7.2 CVE-2022-35944 >= 2.0.0, < 2.2.34, >= 3.0.0, < 3.0.66 2.2.34, 3.0.66
13.07.2022

October CMS upload process vulnerable to RCE via Race Condition

Alta · 8.1 CVE-2022-24800 < 1.0.476, >= 1.1.0, < 1.1.12, >= 2.0.0, < 2.2.15 1.0.476, 1.1.12, 2.2.15
23.02.2022

Authenticated remote code execution in October CMS

Alta · 7.2 CVE-2022-21705 < 1.0.474, >= 1.1.0, < 1.1.10, >= 2.0.0, < 2.1.27 1.0.474, 1.1.10, 2.1.27
14.01.2022

october/system arbitrary code execution

Alta · 8.8 CVE-2021-32650 >= 1.1.0, < 1.1.6, < 1.0.473 1.1.6, 1.0.473
14.01.2022

October/System authenticated file write leads to remote code execution

Alta · 8.8 CVE-2021-32649 >= 1.1.0, < 1.1.6, < 1.0.473 1.1.6, 1.0.473
06.10.2021

Deleted Admin Can Sign In to Admin Interface

Alta · 7.2 CVE-2021-41126 >= 2.1.0, < 2.1.12 2.1.12
30.08.2021

October CMS auth bypass and account takeover

Alta · 7.4 CVE-2021-29487 < 1.0.472, >= 1.1.1, < 1.1.5 1.0.472, 1.1.5
30.08.2021

Account Takeover in Octobercms

Alta · 8.2 Explotada en ataques CVE-2021-32648 < 1.0.472, >= 1.1.1, < 1.1.5 1.0.472, 1.1.5

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación