Input validation error in October CMS - #VU156194
Published: October 19, 2026
Vulnerability details
The vulnerability allows a remote privileged user to bypass the template sandbox, invoke arbitrary class methods, and potentially execute PHP code through arbitrary file writes.
The vulnerability exists due to incomplete validation of nested callable arguments in the SafeCollection Twig sandbox proxy when forwarding template calls to collection methods. A remote privileged user can use CMS markup editing access to submit collect([$a, $b]).sortBy([[['Class', 'method']]]) to invoke Class::method($a, $b) with attacker-controlled strings, then chain this primitive with File::put to write a CMS template containing a PHP code section that executes on the next page render.
Only installations with cms.safe_mode enabled are affected.