October Rain has a Twig Sandbox Bypass via Collection Methods
A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.
Impact
- Bypass of Twig sandbox restrictions
- Only affects installations with
CMS_SAFE_MODEenabled (disabled by default) - Requires authenticated backend access with CMS template editing permissions
Patches
The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
- Disable
CMS_SAFE_MODEif untrusted template editing is not required - Restrict CMS template editing permissions to fully trusted administrators only
References
- Reported by Łukasz Rybak
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | october/rain | >= 4.0.0, < 4.1.5, < 3.7.13 | 4.1.5, 3.7.13 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-284, CWE-693- Platform
- Composer
- Package
october/rain- Disclosed
- 14.04.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-m5qg-jc75-4jp6 - CC BY 4.0
Vulnerability history: october/rain
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 6
- First → latest
- 08.2020 04.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- Medium 5
Disclosures per year
- 2020: 1
- 2021: 1
- 2022: 1
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 3
-
October Rain has a Twig Sandbox Bypass via Collection Methods this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.