TI-2020-12019 Aliases CVE-2020-15247 GHSA-94vp-rmqv-5875

Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.

LOW 23CWE-862Published 2020-11-23 · Updated 2024-08-04

Key facts

Attack vector: Local
Privileges required: High
User interaction: Required
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, an authenticated backend user with the cms.manage_pages, cms.manage_layouts, or cms.manage_partials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to cms.enableSafeMode being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This is not a problem for anyone that trusts their users with those permissions to normally write & manage PHP within the CMS by not having cms.enableSafeMode enabled, but would be a problem for anyone relying on cms.enableSafeMode to ensure that users with those permissions in production do not have access to write & execute arbitrary PHP. Issue has been patched in Build 469 (v1.0.469) and v1.1.0.

Why it matters now

EPSS 0.00294 22nd percentileScored 2026-11-07

Fix Fixed october (octobercms): 1.0.469october/cms (Packagist): 1.0.469

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
October CMS	october	1.0.319 to before 1.0.469	1.0.469	Patch available	CNA
—	october/cms (Packagist)	1.0.319 to before 1.0.469	1.0.469	Patch available	GHSA-94vp-rmqv-5875

october VendorOctober CMS Affected 1.0.319 to before 1.0.469 Fixed in 1.0.469 Patch available CNA
october/cms (Packagist) Vendor— Affected 1.0.319 to before 1.0.469 Fixed in 1.0.469 Patch available GHSA-94vp-rmqv-5875

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:octobercms:october::::::::	1.0.319 to before 1.0.469	Vulnerable	October CMS

cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:* Versions 1.0.319 to before 1.0.469 Vulnerable ·October CMS

Remediation

Fix · CNA october (octobercms) Fixed in 1.0.469
Fix · GHSA-94vp-rmqv-5875 october/cms (Packagist) Fixed in 1.0.469 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-15247
2026-10-03 Alias added: GHSA-94vp-rmqv-5875

References

Patch 1

https://github.com/octobercms/october/commit/4c650bb775ab849e48202a4923bac93bd74f9982

Advisory 2

Other 1

https://github.com/octobercms/october

TI-2021-12316 Account Takeover in Octobercms KEVCVSS 3.1CRITICAL 9.1
TI-2021-12318 Arbitrary code execution in october/system CVSS 3.1HIGH 8.8
TI-2017-14456 October CMS build 412 is vulnerable to PHP code execution in the file upload… CVSS 3.0HIGH 7.2
TI-2023-23545 A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an… CVSS 3.1MEDIUM 5.4
TI-2023-19223 An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute… CVSS 3.1MEDIUM 5.4
TI-2024-30847 October 3.6.30 allows an authenticated admin account to upload a PDF file containing… CVSS 3.1MEDIUM 4.7

See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences