← Vulnerability feed

Vulnerability record · CVE-2022-21705 · published 23 February 2022

CVE-2022-21705: Octobercms october injection vulnerability

Octobercms · October

Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass `cms.safe_mode` / `cms.enableSafeMode` in order to execute arbitrary code. This issue only affects admin panels that rely on safe mode and restricted permissions. To exploit this vulnerability, an attacker must first have access to the backend area. The issue has been patched in Build 474 (v1.0.474) and v1.1.10. Users unable to upgrade should apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually.

7.2 CVSS 3.1 High EPSS 8.6% · top 5.1% CWE-74 · Injection
7.2CVSS 3.1 base score, v2 8.5
8.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass `cms.safe_mode` / `cms.enableSafeMode` in order to execute arbitrary code. This issue only affects admin panels that rely on safe mode and restricted permissions. To exploit this vulnerability, an attacker must first have access to the backend area. The issue has been patched in Build 474 (v1.0.474) and v1.1.10. Users unable to upgrade should apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe PatchThird Party Advisory
https://github.com/octobercms/october/security/advisories/GHSA-79jw-2f46-wv22 Issue TrackingPatchThird Party Advisory
https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe PatchThird Party Advisory
https://github.com/octobercms/october/security/advisories/GHSA-79jw-2f46-wv22 Issue TrackingPatchThird Party Advisory

Track CVE-2022-21705 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2021-32648October CMS password reset authentication bypassOctober CMS, a Laravel-based CMS, contains an improper authentication flaw in the october/system package. An attacker can request an account password…KEVEPSS 90%analysed9.8CVE-2021-3311Octobercms october insufficient session expiration vulnerabilityAn issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occur…EPSS 2.9%9.8CVE-2017-1000194Octobercms october unrestricted file upload vulnerabilityOctober CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly othe…EPSS 1.2%9.8CVE-2017-1000196Octobercms october code injection vulnerabilityOctober CMS build 412 is vulnerable to PHP code execution in the asset manager functionality resulting in site compromise and possibly other applicat…EPSS 1.9%9.8CVE-2017-1000197Octobercms october vulnerabilityOctober CMS build 412 is vulnerable to file path modification in asset move functionality resulting in creating creating malicious files on the serve…EPSS 1.2%9.1CVE-2023-44382Octobercms october code injection vulnerabilityOctober is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `editor.cms…EPSS 0.87%8.8CVE-2021-32649Octobercms october injection vulnerabilityOctober CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an att…EPSS 1.3%8.8CVE-2021-32650Octobercms october injection vulnerabilityOctober CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an att…EPSS 2.1%

Source: NIST National Vulnerability Database (record CVE-2022-21705), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.