CVE-2026-22692

{"id": "CVE-2026-22692", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22692", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T19:42:23.040347Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "octobercms", "product": "october", "versions": [{"status": "affected", "version": "< 3.7.13"}, {"status": "affected", "version": ">= 4.0.0, < 4.1.5"}]}]}], "published": "2026-04-14T17:16:28.423", "references": [{"url": "https://github.com/octobercms/october/security/advisories/GHSA-m5qg-jc75-4jp6", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections. Exploitation requires authenticated backend access with CMS template editing permissions and only affects installations with CMS_SAFE_MODE enabled (disabled by default). This issue has been fixed in versions 3.7.13 and 4.1.5. To workaround this issue, users can disable CMS_SAFE_MODE if untrusted template editing is not required, and restrict CMS template editing permissions to fully trusted administrators only."}, {"lang": "es", "value": "October es un Sistema de Gesti\u00f3n de Contenidos (CMS) y plataforma web. Las versiones anteriores a la 3.7.13 y las versiones 4.0.0 a la 4.1.4 contienen una vulnerabilidad de bypass de sandbox en la caracter\u00edstica opcional de modo seguro de Twig (CMS_SAFE_MODE). Ciertos m\u00e9todos en el ayudante collect() no estaban correctamente restringidos, permitiendo a usuarios autenticados con permisos de edici\u00f3n de plantillas saltarse las protecciones de sandbox. La explotaci\u00f3n requiere acceso autenticado al backend con permisos de edici\u00f3n de plantillas de CMS y solo afecta a instalaciones con CMS_SAFE_MODE habilitado (deshabilitado por defecto). Este problema ha sido solucionado en las versiones 3.7.13 y 4.1.5. Para aplicar una soluci\u00f3n alternativa a este problema, los usuarios pueden deshabilitar CMS_SAFE_MODE si no se requiere la edici\u00f3n de plantillas no confiables, y restringir los permisos de edici\u00f3n de plantillas de CMS solo a administradores de plena confianza."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD599F53-B664-4667-9A0A-D745EF8D777B", "versionEndExcluding": "3.7.13"}, {"criteria": "cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7AA00A10-35F7-4084-AEE2-2DC6E2844E88", "versionEndExcluding": "4.1.5", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}