CVE-2026-49400: PHP Object Injection Sandbox Escape in October CMS SessionMaker
Vulnerability ID: CVE-2026-49400
CVSS Score: 3.3
Published: 2026-09-14
A security vulnerability in October Content Management System (CMS) involves the deserialization of untrusted data (CWE-502) within the backend SessionMaker trait. Prior to the patched versions, October CMS stored widget session states as base64-encoded serialized PHP objects. When loading these states, the application consumed them using unserialize() without enforcing class restrictions (allowed_classes). In configurations where cms.safe_mode is enabled to sandbox users with markup editor privileges, an attacker can exploit this behavior to instantiate arbitrary PHP classes and execute arbitrary code via accessible gadget chains.
TL;DR
October CMS unserialized widget session states without class restrictions, enabling PHP Object Injection and sandbox escapes in sandboxed safe-mode deployments.
Technical Details
- CWE ID: CWE-502: Deserialization of Untrusted Data
- Attack Vector: Network (AV:N)
- CVSS v3.1 Score: 3.3
- Exploit Status: none
- KEV Status: Not Listed
- Impact: Sandbox Escape / Remote Code Execution
Affected Systems
- October CMS 3.x installations running prior to version 3.7.17
- October CMS 4.x installations running prior to version 4.2.23
-
October CMS: < 3.7.17 (Fixed in:
3.7.17) -
October CMS: >= 4.0.0, < 4.2.23 (Fixed in:
4.2.23)
Mitigation Strategies
- Upgrade October CMS core dependencies to patched releases.
- Restrict CMS backend access strictly to trusted administrators.
- Avoid relying solely on cms.safe_mode as a hard security boundary for untrusted backend users.
Remediation Steps:
- Identify the current active version of October CMS in the application environment.
- If utilizing the 3.x release line, apply updates to transition to version 3.7.17 or higher.
- If utilizing the 4.x release line, apply updates to transition to version 4.2.23 or higher.
- Verify the patch application by ensuring the SessionMaker trait contains the json_decode and allowed_classes parameters.
References
Read the full report for CVE-2026-49400 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)