Description

October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security policy that allowed a chained bypass when `cms.safe_mode` is enabled. The Laravel session store was exposed to Twig with unrestricted method access, and raw SQL methods reachable through Eloquent's `__call` forwarding were not blocked across the full builder chain. When combined, a backend user with CMS markup editing access could read arbitrary database values via raw SQL expressions and write to the backend authentication session key, forging a backend session as another existing user. The scope of impact is narrow. Safe Mode is a niche feature, primarily used for demo installations and multi-tenant or shared-editor scenarios where untrusted users are deliberately granted access to the CMS markup editor. Standard production deployments do not enable Safe Mode, because under normal October CMS guidance backend access - including markup editing - is restricted to trusted administrators, and direct PHP injection through markup is already possible without Safe Mode in that configuration. This issue only affects sites that meet all of the following conditions: `cms.safe_mode` is enabled (a deliberate opt-in for demos or untrusted-editor scenarios; the site has at least one backend user with CMS markup editing access who is not intended to be trusted as a full administrator; and the site has at least one existing superuser account whose session the lower-privileged user can impersonate. The vulnerability has been patched in v3.7.17 and v4.2.21. The Laravel session store is now wrapped in a proxy that exposes only an explicit subset of read/write methods and rejects writes to reserved session key prefixes (`admin_auth`, `october_auth`, `login_*`, `_token`, and other framework internals). Raw SQL and subquery methods (`selectRaw`, `whereRaw`, `orderByRaw`, `joinSub`, and related) are now blocked on `Query\Builder`, `Eloquent\Builder`, and `Eloquent\Model` so the blocklist is consistent across the `__call` forwarding chain. All sites that enable `cms.safe_mode` are encouraged to upgrade to the latest patched version. A workaround is available. Restrict CMS markup editing access to fully trusted administrators only - the standard October CMS recommendation for any deployment. Note that disabling `cms.safe_mode` is not a workaround; Safe Mode is the boundary this issue affects, and disabling it removes the only sandbox between markup editors and the server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-14T18:17:47.687Z",
  "pubdate": "2026-09-14T18:17:47.687Z",
  "executiveSummary": "A critical security vulnerability exists in the October System module for October CMS, specifically within the Twig sandbox security policy. The flaw permits a chained bypass when 'cms.safe_mode' is enabled, allowing unauthorized backend users with CMS markup editing privileges to execute arbitrary SQL queries and manipulate session data.\nThis vulnerability is classified as a sandbox escape and an unauthorized session impersonation flaw. It allows an attacker to escalate privileges by forging backend sessions for existing superuser accounts.\nThe scope of impact is restricted to installations where 'cms.safe_mode' is active, which is typically intended for multi-tenant or shared-editor environments. While standard production deployments are generally unaffected due to the existing trust model regarding CMS markup editors, the potential for total administrative account takeover represents a significant security risk for the specified configurations.\nExploitation requires an attacker to possess backend access with permissions to edit CMS markup. The vulnerability facilitates unauthorized database interaction via Eloquent's '__call' forwarding chain, which was insufficiently restricted in versions prior to 3.7.17 and 4.2.21.",
  "technicalDetails": "The root cause of the vulnerability lies in an inadequate sandboxing implementation for the Twig template engine when 'cms.safe_mode' is enabled. The vulnerability stems from two primary architectural failures: the exposure of the Laravel session store to Twig with unrestricted method access, and a lack of proper filtering on raw SQL execution methods within the Eloquent ORM.\nIn the vulnerable versions, the Twig environment permitted access to the Laravel session store object. Because the sandbox policy failed to restrict method calls on this object, an attacker could invoke methods to perform unauthorized write operations on session keys. Simultaneously, the Eloquent query builder's '__call' magic method forwarded requests to underlying methods without sufficiently blacklisting sensitive SQL execution functions, such as 'selectRaw', 'whereRaw', 'orderByRaw', and 'joinSub'.\nThe attack flow follows a chained execution pattern. First, the attacker, logged in as a user with markup editing access, embeds malicious Twig code within a CMS template. Second, the attacker leverages the unrestricted access to the Laravel session store to identify and manipulate authentication-related keys. Third, by utilizing the Eloquent 'whereRaw' or 'selectRaw' capabilities, the attacker performs arbitrary database queries to exfiltrate sensitive data or manipulate the internal session storage state. By writing to reserved session keys such as 'admin_auth' or 'october_auth', the attacker effectively forces the system to recognize their current session as that of a high-privileged administrator.\nThis bypass effectively neutralizes the purpose of 'cms.safe_mode', which is designed to limit the capabilities of untrusted editors. By chain-linking the ability to execute raw database queries with the ability to modify session persistence, an attacker can achieve privilege escalation and persist as a superuser. The issue was addressed by introducing a proxy wrapper around the Laravel session store to enforce a strict whitelist of allowed methods and by applying a global blocklist for raw SQL methods across 'Query\\Builder', 'Eloquent\\Builder', and 'Eloquent\\Model' components. The fix ensures that the 'call' forwarding chain respects the security boundary regardless of the entry point, effectively preventing the concatenation of template-based template manipulation and backend session forgery."
}