Read the docs
TI-2022-06081 Aliases CVE-2022-21705GHSA-79jw-2f46-wv22

Authenticated remote code execution in octobercms

Priority MEDIUM 45CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass `cms.safe_mode` / `cms.enableSafeMode` in order to execute arbitrary code. This issue only affects admin panels that rely on safe mode and restricted permissions. To exploit this vulnerability, an attacker must first have access to the backend area. The issue has been patched in Build 474 (v1.0.474) and v1.1.10. Users unable to upgrade should apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0865 95th percentileScored 2026-11-07
Fix Fixed october (octobercms): 1.0.474, 1.1.10, 2.1.27october/system (Packagist): 1.0.474, 1.1.10, 2.1.27

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
October CMSoctoberbefore 1.0.474; 1.1.0 to before 1.1.10; 2.0.0 to before 2.1.271.0.474, 1.1.10, 2.1.27Patch availableCNA
—october/system (Packagist)before 1.0.4741.0.474Patch availableGHSA-79jw-2f46-wv22
—october/system (Packagist)1.1.0 to before 1.1.101.1.10Patch availableGHSA-79jw-2f46-wv22
—october/system (Packagist)2.0.0 to before 2.1.272.1.27Patch availableGHSA-79jw-2f46-wv22
  • october VendorOctober CMS Affected before 1.0.474; 1.1.0 to before 1.1.10; 2.0.0 to before 2.1.27 Fixed in 1.0.474, 1.1.10, 2.1.27 Patch available CNA
  • october/system (Packagist) Vendor— Affected before 1.0.474 Fixed in 1.0.474 Patch available GHSA-79jw-2f46-wv22
  • october/system (Packagist) Vendor— Affected 1.1.0 to before 1.1.10 Fixed in 1.1.10 Patch available GHSA-79jw-2f46-wv22
  • october/system (Packagist) Vendor— Affected 2.0.0 to before 2.1.27 Fixed in 2.1.27 Patch available GHSA-79jw-2f46-wv22

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*before 1.0.474; 1.1.0 to before 1.1.10; 2.0.0 to before 2.1.27VulnerableOctober CMS
  • cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:* Versions before 1.0.474; 1.1.0 to before 1.1.10; 2.0.0 to before 2.1.27 Vulnerable ·October CMS

Remediation

  • Fix · CNA october (octobercms) Fixed in 1.0.474, 1.1.10, 2.1.27
  • Fix · GHSA-79jw-2f46-wv22 october/system (Packagist) Fixed in 1.0.474 Advisory →
  • Fix · GHSA-79jw-2f46-wv22 october/system (Packagist) Fixed in 1.1.10 Advisory →
  • Fix · GHSA-79jw-2f46-wv22 october/system (Packagist) Fixed in 2.1.27 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-21705
  2. 2026-10-03 Alias added: GHSA-79jw-2f46-wv22
  3. 2026-10-11 EPSS moved to the 95th–99th percentile

References

Patch 2

Advisory 1

Other 1

  • TI-2021-12316 Account Takeover in Octobercms KEVCVSS 3.1CRITICAL 9.1
  • TI-2021-12318 Arbitrary code execution in october/system CVSS 3.1HIGH 8.8
  • TI-2017-14456 October CMS build 412 is vulnerable to PHP code execution in the file upload… CVSS 3.0HIGH 7.2
  • TI-2023-23545 A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an… CVSS 3.1MEDIUM 5.4
  • TI-2023-19223 An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute… CVSS 3.1MEDIUM 5.4
  • TI-2024-30847 October 3.6.30 allows an authenticated admin account to upload a PDF file containing… CVSS 3.1MEDIUM 4.7
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences