SB2026101954 - Multiple vulnerabilities in October CMS

Description

This security bulletin contains information about 2 vulnerabilities.

1) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to bypass the template sandbox, invoke arbitrary class methods, and potentially execute PHP code through arbitrary file writes.

The vulnerability exists due to incomplete validation of nested callable arguments in the SafeCollection Twig sandbox proxy when forwarding template calls to collection methods. A remote privileged user can use CMS markup editing access to submit collect([$a, $b]).sortBy([[['Class', 'method']]]) to invoke Class::method($a, $b) with attacker-controlled strings, then chain this primitive with File::put to write a CMS template containing a PHP code section that executes on the next page render.

Only installations with cms.safe_mode enabled are affected.

2) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to bypass Tailor sub-permission checks and publish or overwrite entries within an accessible section without the corresponding permissions.

The vulnerability exists due to incorrect authorization in the Tailor bulk action controller when processing section imports. A remote privileged user can submit import data setting is_enabled and published_at or use update_existing to publish or overwrite entries without the sub-permissions enforced by the standard entry editor.

A meaningful privilege gap arises only in deployments that split base, create, and publish permissions across distinct roles.

Remediation

Install update from vendor's website.

References

• https://github.com/octobercms/october/security/advisories/GHSA-8rgj-g632-3qfp
• https://github.com/octobercms/october/security/advisories/GHSA-99g4-59v5-g9cw