Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections. Exploitation requires authenticated backend access with CMS template editing permissions and only affects installations with CMS_SAFE_MODE enabled (disabled by default). This issue has been fixed in versions 3.7.13 and 4.1.5. To workaround this issue, users can disable CMS_SAFE_MODE if untrusted template editing is not required, and restrict CMS template editing permissions to fully trusted administrators only.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-22692 October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the… https://www.cve.org/CVERecord?id=CVE-2026-22692
Post summary
The post briefly describes CVE-2026-22692 as a sandbox‑bypass flaw affecting specific CMS versions but provides no PoC, exploit code, or patch information.
🟠 October CMS, Twig Sandbox Bypass, #CVE-2026-22692 (Moderate) https://dailycve.com/october-cms-twig-sandbox-bypass-cve-2026-22692-moderate/
Post summary
The tweet shares a link to a DailyCVE article covering a moderate severity Twig Sandbox Bypass vulnerability (CVE‑2026‑22692) in October CMS, without detailing PoCs, exploits, or mitigation steps.
CVE-2026-22692 CVE-2026-22692 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-22692
Post summary
The post only lists the CVE identifier and provides a link to a Vulmon page without offering any further technical or exploit details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | octobercms | october | - | - | - |