https://vulnerability.circl.lu/sightings/feed 2026-09-19T02:33:53.472455+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/6604d4d3-28f0-4ed2-b5ef-c615328e9283/export 2026-09-19T02:33:53.478969+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "6604d4d3-28f0-4ed2-b5ef-c615328e9283", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-2ff2-mx52-q8wp", "type": "seen", "source": "https://gist.github.com/alon710/65b5c64d62229349e54e21de9ec5c14b", "content": "# CVE-2026-49400: CVE-2026-49400: PHP Object Injection Sandbox Escape in October CMS SessionMaker\n\n> **CVSS Score:** 3.3\n> **Published:** 2026-09-14\n> **Full Report:** https://cvereports.com/reports/CVE-2026-49400\n\n## Summary\nA security vulnerability in October Content Management System (CMS) involves the deserialization of untrusted data (CWE-502) within the backend SessionMaker trait. Prior to the patched versions, October CMS stored widget session states as base64-encoded serialized PHP objects. When loading these states, the application consumed them using unserialize() without enforcing class restrictions (allowed_classes). In configurations where cms.safe_mode is enabled to sandbox users with markup editor privileges, an attacker can exploit this behavior to instantiate arbitrary PHP classes and execute arbitrary code via accessible gadget chains.\n\n## TL;DR\nOctober CMS unserialized widget session states without class restrictions, enabling PHP Object Injection and sandbox escapes in sandboxed safe-mode deployments.\n\n## Technical Details\n\n- **CWE ID**: CWE-502: Deserialization of Untrusted Data\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 3.3\n- **Exploit Status**: none\n- **KEV Status**: Not Listed\n- **Impact**: Sandbox Escape / Remote Code Execution\n\n## Affected Systems\n\n- October CMS 3.x installations running prior to version 3.7.17\n- October CMS 4.x installations running prior to version 4.2.23\n- **October CMS**: < 3.7.17 (Fixed in: `3.7.17`)\n- **October CMS**: >= 4.0.0, < 4.2.23 (Fixed in: `4.2.23`)\n\n## Mitigation\n\n- Upgrade October CMS core dependencies to patched releases.\n- Restrict CMS backend access strictly to trusted administrators.\n- Avoid relying solely on cms.safe_mode as a hard security boundary for untrusted backend users.\n\n**Remediation Steps:**\n1. Identify the current active version of October CMS in the application environment.\n2. If utilizing the 3.x release line, apply updates to transition to version 3.7.17 or higher.\n3. If utilizing the 4.x release line, apply updates to transition to version 4.2.23 or higher.\n4. Verify the patch application by ensuring the SessionMaker trait contains the json_decode and allowed_classes parameters.\n\n## References\n\n- [October CMS GitHub Security Advisory](https://github.com/octobercms/october/security/advisories/GHSA-2ff2-mx52-q8wp)\n- [NVD Entry for CVE-2026-49400](https://nvd.nist.gov/vuln/detail/CVE-2026-49400)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-49400)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-49400) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-15T00:31:20.468567Z"} 2026-09-15T00:31:20.468567+00:00