GitHub Advisoryadvisory · Packagist

GHSA-m5qg-jc75-4jp6 October Rain has a Twig Sandbox Bypass via Collection Methods

MEDIUM Published 2026-04-14 Modified 2026-04-14 Official page ↗
Aliases
CVE-2026-22692
Ecosystem
Packagist
Packages
october/rain
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-284, CWE-693
Reviewed
2026-04-14

Affected packages

• Packagist october/rain: >= 4.0.0, < 4.1.5 → fixed in 4.1.5 • Packagist october/rain: < 3.7.13 → fixed in 3.7.13

Description

A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (`CMS_SAFE_MODE`). Certain methods on the `collect()` helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections. Impact • Bypass of Twig sandbox restrictions • Only affects installations with `CMS_SAFE_MODE` enabled (disabled by default) • Requires authenticated backend access with CMS template editing permissions Patches The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version. Workarounds If upgrading immediately is not possible: • Disable `CMS_SAFE_MODE` if untrusted template editing is not required • Restrict CMS template editing permissions to fully trusted administrators only References • Reported by Łukasz Rybak

Related

Alias · CVE (1)

  • CVE-2026-22692 October is a Content Management System (CMS) and web platform. vulnerability

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-693 Protection Mechanism Failure weakness

References