CVE-2022-35944

Published: Oct 13, 2022Modified: Jun 17, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

October is a self-hosted Content Management System (CMS) platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin panel and permission to open the "Editor" section, they can bypass the Safe Mode (`cms.safe_mode`) restriction to introduce new PHP code in a CMS template using a specially crafted request. The issue has been patched in versions 2.2.34 and 3.0.66.

Affected (2)

Products: Octobercms: October

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Octobercms October	Before 2.2.34
Octobercms October	From 3.0.00 to 3.0.66

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (2)

https://github.com/octobercms/october/security/advisories/GHSA-x4q7-m6fp-4v9v

Source: security-advisories@github.com

Third Party Advisory

https://github.com/octobercms/october/security/advisories/GHSA-x4q7-m6fp-4v9v

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.