v4.3.3
patch
Jul 23, 2026
Released
Jul 23, 2026
Runtime
^8.1
Checksum
Funding
[]
Dependencies
(15)
composer/composer
^2.0.0
composer/installers
^1 || ^2
doctrine/dbal
^2.13.3|^3.1.4
enshrined/svg-sanitize
^0.22
intervention/image
^3.10
jaybizzle/crawler-detect
^1.3
larajax/larajax
^2.0
laravel/tinker
~2.0|~3.0
+ 7 more
v4.3.2
patch
Jul 16, 2026
Released
Jul 16, 2026
Checksum
v4.3.0
minor
Jun 14, 2026
Released
Jun 14, 2026
Checksum
v4.2.24
patch
Jun 02, 2026
Released
Jun 02, 2026
Checksum
v4.2.22
patch
May 22, 2026
Released
May 22, 2026
Checksum
v4.2.21
patch
May 18, 2026
Released
May 18, 2026
Runtime
^8.1
Checksum
Dependencies
(15)
composer/composer
^2.0.0
composer/installers
^1 || ^2
doctrine/dbal
^2.13.3|^3.1.4
enshrined/svg-sanitize
^0.22
intervention/image
^3.10
jaybizzle/crawler-detect
^1.3
larajax/larajax
^2.0
laravel/tinker
~2.0|~3.0
+ 7 more
v4.2.20
patch
May 07, 2026
Released
May 07, 2026
Checksum
v4.2.19
patch
Apr 23, 2026
Released
Apr 23, 2026
Checksum
v4.2.18
patch
Apr 23, 2026
Released
Apr 23, 2026
Checksum
v4.2.17
patch
Apr 18, 2026
Released
Apr 18, 2026
Checksum
v4.2.16
patch
Apr 15, 2026
Released
Apr 15, 2026
Runtime
^8.1
Checksum
Dependencies
(15)
composer/composer
^2.0.0
composer/installers
^1 || ^2
doctrine/dbal
^2.13.3|^3.1.4
enshrined/svg-sanitize
^0.15|^0.16|^0.17|^0.18|^0.19|^0.20|^0.21|^0.22
intervention/image
^3.10
jaybizzle/crawler-detect
^1.3
larajax/larajax
^2.0
laravel/tinker
~2.0|~3.0
+ 7 more
v4.2.15
patch
Apr 09, 2026
Released
Apr 09, 2026
Checksum
v4.2.14
patch
Apr 07, 2026
Released
Apr 07, 2026
Checksum
v4.2.13
patch
Apr 04, 2026
Released
Apr 04, 2026
Checksum
v4.2.12
patch
Apr 04, 2026
Released
Apr 04, 2026
Checksum
v4.2.11
patch
Apr 01, 2026
Released
Apr 01, 2026
Checksum
v4.2.10
patch
Mar 30, 2026
Released
Mar 30, 2026
Checksum
v4.2.3
patch
Mar 20, 2026
Released
Mar 20, 2026
Checksum
v4.2.0
minor
Mar 20, 2026
Released
Mar 20, 2026
Checksum
v4.1.19
patch
Mar 15, 2026
Released
Mar 15, 2026
Runtime
^8.1
Checksum
Dependencies
(13)
composer/composer
^2.0.0
composer/installers
^1 || ^2
doctrine/dbal
^2.13.3|^3.1.4
intervention/image
^3.10
jaybizzle/crawler-detect
^1.3
larajax/larajax
^2.0
laravel/tinker
~2.0
league/csv
~9.1
+ 5 more
v4.1.18
patch
Mar 10, 2026
Released
Mar 10, 2026
Checksum
v4.1.17
patch
Feb 25, 2026
Released
Feb 25, 2026
Checksum
v4.1.14
patch
Feb 19, 2026
Released
Feb 19, 2026
Runtime
^8.1
Checksum
Dependencies
(13)
composer/composer
^2.0.0
composer/installers
^1 || ^2
doctrine/dbal
^2.13.3|^3.1.4
intervention/image
^3.10
jaybizzle/crawler-detect
^1.3
larajax/larajax
^2.0
laravel/tinker
~2.0
league/csv
~9.1
+ 5 more
v4.1.13
patch
Feb 10, 2026
Released
Feb 10, 2026
Checksum
v3.7.16
patch
Feb 09, 2026
Released
Feb 09, 2026
Runtime
^8.0.2
Checksum
Dependencies
(11)
composer/composer
^2.0.0
doctrine/dbal
^2.13.3|^3.1.4
guzzlehttp/guzzle
^7.5
laravel/tinker
~2.0
league/csv
~9.1
linkorb/jsmin-php
~1.0
nesbot/carbon
^2.0
scssphp/scssphp
~1.0
+ 3 more
v4.1.12
patch
Feb 09, 2026
Released
Feb 09, 2026
Checksum
v4.1.10
patch
Feb 07, 2026
Released
Feb 07, 2026
Checksum
v4.1.9
patch
2 CVEs
CVE-2026-25133
GHSA-gcqv-f29m-67gr
Apr 14, 2026
October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.
Impact
Stored XSS via malicious SVG files uploaded through the Media Manager
Could allow privilege escalation if a superuser views or embeds the malicious SVG
Requires authenticated backend access with media upload permissions (media.library.create)
SVG must be viewed or embedded in a page to trigger
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable SVG uploads by adding svg to the blocked extensions in media configuration
Set media.clean_vectors to true in configuration (enabled by default)
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-25125
GHSA-g6v3-wv4j-x9hg
Apr 14, 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.
Impact
Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
Could enable further attacks: database access, cookie forgery, AWS resource access
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Restrict Editor tool access to fully trusted administrators only
Ensure database and cloud service credentials are not accessible from the web server's network
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
Jan 26, 2026
Released
Jan 26, 2026
Checksum
v4.1.6
patch
2 CVEs
CVE-2026-25133
GHSA-gcqv-f29m-67gr
Apr 14, 2026
October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.
Impact
Stored XSS via malicious SVG files uploaded through the Media Manager
Could allow privilege escalation if a superuser views or embeds the malicious SVG
Requires authenticated backend access with media upload permissions (media.library.create)
SVG must be viewed or embedded in a page to trigger
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable SVG uploads by adding svg to the blocked extensions in media configuration
Set media.clean_vectors to true in configuration (enabled by default)
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-25125
GHSA-g6v3-wv4j-x9hg
Apr 14, 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.
Impact
Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
Could enable further attacks: database access, cookie forgery, AWS resource access
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Restrict Editor tool access to fully trusted administrators only
Ensure database and cloud service credentials are not accessible from the web server's network
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
Jan 17, 2026
Released
Jan 17, 2026
Checksum
v3.7.13
patch
2 CVEs
CVE-2026-25133
GHSA-gcqv-f29m-67gr
Apr 14, 2026
October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.
Impact
Stored XSS via malicious SVG files uploaded through the Media Manager
Could allow privilege escalation if a superuser views or embeds the malicious SVG
Requires authenticated backend access with media upload permissions (media.library.create)
SVG must be viewed or embedded in a page to trigger
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable SVG uploads by adding svg to the blocked extensions in media configuration
Set media.clean_vectors to true in configuration (enabled by default)
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-25125
GHSA-g6v3-wv4j-x9hg
Apr 14, 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.
Impact
Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
Could enable further attacks: database access, cookie forgery, AWS resource access
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Restrict Editor tool access to fully trusted administrators only
Ensure database and cloud service credentials are not accessible from the web server's network
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
Jan 09, 2026
Released
Jan 09, 2026
Checksum
v4.1.5
patch
2 CVEs
CVE-2026-25133
GHSA-gcqv-f29m-67gr
Apr 14, 2026
October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.
Impact
Stored XSS via malicious SVG files uploaded through the Media Manager
Could allow privilege escalation if a superuser views or embeds the malicious SVG
Requires authenticated backend access with media upload permissions (media.library.create)
SVG must be viewed or embedded in a page to trigger
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable SVG uploads by adding svg to the blocked extensions in media configuration
Set media.clean_vectors to true in configuration (enabled by default)
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-25125
GHSA-g6v3-wv4j-x9hg
Apr 14, 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.
Impact
Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
Could enable further attacks: database access, cookie forgery, AWS resource access
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Restrict Editor tool access to fully trusted administrators only
Ensure database and cloud service credentials are not accessible from the web server's network
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
Jan 09, 2026
Released
Jan 09, 2026
Checksum
v4.1.4
patch
3 CVEs
CVE-2026-25133
GHSA-gcqv-f29m-67gr
Apr 14, 2026
October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.
Impact
Stored XSS via malicious SVG files uploaded through the Media Manager
Could allow privilege escalation if a superuser views or embeds the malicious SVG
Requires authenticated backend access with media upload permissions (media.library.create)
SVG must be viewed or embedded in a page to trigger
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable SVG uploads by adding svg to the blocked extensions in media configuration
Set media.clean_vectors to true in configuration (enabled by default)
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-25125
GHSA-g6v3-wv4j-x9hg
Apr 14, 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.
Impact
Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
Could enable further attacks: database access, cookie forgery, AWS resource access
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Restrict Editor tool access to fully trusted administrators only
Ensure database and cloud service credentials are not accessible from the web server's network
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-22692
GHSA-m5qg-jc75-4jp6
Apr 14, 2026
October Rain has a Twig Sandbox Bypass via Collection Methods
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.
Impact
Bypass of Twig sandbox restrictions
Only affects installations with CMS_SAFE_MODE enabled (disabled by default)
Requires authenticated backend access with CMS template editing permissions
Patches
The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable CMS_SAFE_MODE if untrusted template editing is not required
Restrict CMS template editing permissions to fully trusted administrators only
References
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 346 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated Apr 14, 2026 · Source: OSV.dev
Jan 06, 2026
Released
Jan 06, 2026
Checksum
v4.1.1
patch
3 CVEs
CVE-2026-25133
GHSA-gcqv-f29m-67gr
Apr 14, 2026
October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.
Impact
Stored XSS via malicious SVG files uploaded through the Media Manager
Could allow privilege escalation if a superuser views or embeds the malicious SVG
Requires authenticated backend access with media upload permissions (media.library.create)
SVG must be viewed or embedded in a page to trigger
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable SVG uploads by adding svg to the blocked extensions in media configuration
Set media.clean_vectors to true in configuration (enabled by default)
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-25125
GHSA-g6v3-wv4j-x9hg
Apr 14, 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.
Impact
Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
Could enable further attacks: database access, cookie forgery, AWS resource access
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Restrict Editor tool access to fully trusted administrators only
Ensure database and cloud service credentials are not accessible from the web server's network
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-22692
GHSA-m5qg-jc75-4jp6
Apr 14, 2026
October Rain has a Twig Sandbox Bypass via Collection Methods
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.
Impact
Bypass of Twig sandbox restrictions
Only affects installations with CMS_SAFE_MODE enabled (disabled by default)
Requires authenticated backend access with CMS template editing permissions
Patches
The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable CMS_SAFE_MODE if untrusted template editing is not required
Restrict CMS template editing permissions to fully trusted administrators only
References
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 346 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated Apr 14, 2026 · Source: OSV.dev
Jan 04, 2026
Released
Jan 04, 2026
Runtime
^8.0.2
Checksum
Dependencies
(13)
composer/composer
^2.0.0
composer/installers
^1 || ^2
doctrine/dbal
^2.13.3|^3.1.4
intervention/image
^3.10
jaybizzle/crawler-detect
^1.3
larajax/larajax
^2.0
laravel/tinker
~2.0
league/csv
~9.1
+ 5 more
v4.1.0
minor
3 CVEs
CVE-2026-25133
GHSA-gcqv-f29m-67gr
Apr 14, 2026
October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.
Impact
Stored XSS via malicious SVG files uploaded through the Media Manager
Could allow privilege escalation if a superuser views or embeds the malicious SVG
Requires authenticated backend access with media upload permissions (media.library.create)
SVG must be viewed or embedded in a page to trigger
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable SVG uploads by adding svg to the blocked extensions in media configuration
Set media.clean_vectors to true in configuration (enabled by default)
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-25125
GHSA-g6v3-wv4j-x9hg
Apr 14, 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.
Impact
Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
Could enable further attacks: database access, cookie forgery, AWS resource access
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Restrict Editor tool access to fully trusted administrators only
Ensure database and cloud service credentials are not accessible from the web server's network
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-22692
GHSA-m5qg-jc75-4jp6
Apr 14, 2026
October Rain has a Twig Sandbox Bypass via Collection Methods
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.
Impact
Bypass of Twig sandbox restrictions
Only affects installations with CMS_SAFE_MODE enabled (disabled by default)
Requires authenticated backend access with CMS template editing permissions
Patches
The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable CMS_SAFE_MODE if untrusted template editing is not required
Restrict CMS template editing permissions to fully trusted administrators only
References
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 346 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated Apr 14, 2026 · Source: OSV.dev
Jan 04, 2026
Released
Jan 04, 2026
Checksum
v4.0.22
patch
3 CVEs
CVE-2026-25133
GHSA-gcqv-f29m-67gr
Apr 14, 2026
October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.
Impact
Stored XSS via malicious SVG files uploaded through the Media Manager
Could allow privilege escalation if a superuser views or embeds the malicious SVG
Requires authenticated backend access with media upload permissions (media.library.create)
SVG must be viewed or embedded in a page to trigger
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable SVG uploads by adding svg to the blocked extensions in media configuration
Set media.clean_vectors to true in configuration (enabled by default)
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-25125
GHSA-g6v3-wv4j-x9hg
Apr 14, 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.
Impact
Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
Could enable further attacks: database access, cookie forgery, AWS resource access
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Restrict Editor tool access to fully trusted administrators only
Ensure database and cloud service credentials are not accessible from the web server's network
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-22692
GHSA-m5qg-jc75-4jp6
Apr 14, 2026
October Rain has a Twig Sandbox Bypass via Collection Methods
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.
Impact
Bypass of Twig sandbox restrictions
Only affects installations with CMS_SAFE_MODE enabled (disabled by default)
Requires authenticated backend access with CMS template editing permissions
Patches
The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable CMS_SAFE_MODE if untrusted template editing is not required
Restrict CMS template editing permissions to fully trusted administrators only
References
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 346 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated Apr 14, 2026 · Source: OSV.dev
Dec 17, 2025
Released
Dec 17, 2025
Runtime
^8.0.2
Checksum
Dependencies
(11)
composer/composer
^2.0.0
composer/installers
^1 || ^2
doctrine/dbal
^2.13.3|^3.1.4
jaybizzle/crawler-detect
^1.3
laravel/tinker
~2.0
league/csv
~9.1
linkorb/jsmin-php
~1.0
scssphp/scssphp
~1.0
+ 3 more
v4.0.20
patch
3 CVEs
CVE-2026-25133
GHSA-gcqv-f29m-67gr
Apr 14, 2026
October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.
Impact
Stored XSS via malicious SVG files uploaded through the Media Manager
Could allow privilege escalation if a superuser views or embeds the malicious SVG
Requires authenticated backend access with media upload permissions (media.library.create)
SVG must be viewed or embedded in a page to trigger
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable SVG uploads by adding svg to the blocked extensions in media configuration
Set media.clean_vectors to true in configuration (enabled by default)
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-25125
GHSA-g6v3-wv4j-x9hg
Apr 14, 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.
Impact
Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
Could enable further attacks: database access, cookie forgery, AWS resource access
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Restrict Editor tool access to fully trusted administrators only
Ensure database and cloud service credentials are not accessible from the web server's network
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-22692
GHSA-m5qg-jc75-4jp6
Apr 14, 2026
October Rain has a Twig Sandbox Bypass via Collection Methods
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.
Impact
Bypass of Twig sandbox restrictions
Only affects installations with CMS_SAFE_MODE enabled (disabled by default)
Requires authenticated backend access with CMS template editing permissions
Patches
The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable CMS_SAFE_MODE if untrusted template editing is not required
Restrict CMS template editing permissions to fully trusted administrators only
References
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 346 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated Apr 14, 2026 · Source: OSV.dev
Dec 17, 2025
Released
Dec 17, 2025
Checksum
v4.0.16
patch
3 CVEs
CVE-2026-25133
GHSA-gcqv-f29m-67gr
Apr 14, 2026
October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.
Impact
Stored XSS via malicious SVG files uploaded through the Media Manager
Could allow privilege escalation if a superuser views or embeds the malicious SVG
Requires authenticated backend access with media upload permissions (media.library.create)
SVG must be viewed or embedded in a page to trigger
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable SVG uploads by adding svg to the blocked extensions in media configuration
Set media.clean_vectors to true in configuration (enabled by default)
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-25125
GHSA-g6v3-wv4j-x9hg
Apr 14, 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.
Impact
Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
Could enable further attacks: database access, cookie forgery, AWS resource access
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Restrict Editor tool access to fully trusted administrators only
Ensure database and cloud service credentials are not accessible from the web server's network
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-22692
GHSA-m5qg-jc75-4jp6
Apr 14, 2026
October Rain has a Twig Sandbox Bypass via Collection Methods
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.
Impact
Bypass of Twig sandbox restrictions
Only affects installations with CMS_SAFE_MODE enabled (disabled by default)
Requires authenticated backend access with CMS template editing permissions
Patches
The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable CMS_SAFE_MODE if untrusted template editing is not required
Restrict CMS template editing permissions to fully trusted administrators only
References
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 346 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated Apr 14, 2026 · Source: OSV.dev
Nov 11, 2025
Released
Nov 11, 2025
Checksum
v4.0.13
patch
3 CVEs
CVE-2026-25133
GHSA-gcqv-f29m-67gr
Apr 14, 2026
October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.
Impact
Stored XSS via malicious SVG files uploaded through the Media Manager
Could allow privilege escalation if a superuser views or embeds the malicious SVG
Requires authenticated backend access with media upload permissions (media.library.create)
SVG must be viewed or embedded in a page to trigger
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable SVG uploads by adding svg to the blocked extensions in media configuration
Set media.clean_vectors to true in configuration (enabled by default)
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-25125
GHSA-g6v3-wv4j-x9hg
Apr 14, 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.
Impact
Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
Could enable further attacks: database access, cookie forgery, AWS resource access
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Restrict Editor tool access to fully trusted administrators only
Ensure database and cloud service credentials are not accessible from the web server's network
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-22692
GHSA-m5qg-jc75-4jp6
Apr 14, 2026
October Rain has a Twig Sandbox Bypass via Collection Methods
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.
Impact
Bypass of Twig sandbox restrictions
Only affects installations with CMS_SAFE_MODE enabled (disabled by default)
Requires authenticated backend access with CMS template editing permissions
Patches
The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable CMS_SAFE_MODE if untrusted template editing is not required
Restrict CMS template editing permissions to fully trusted administrators only
References
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 346 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated Apr 14, 2026 · Source: OSV.dev
Nov 01, 2025
Released
Nov 01, 2025
Checksum
v4.0.12
patch
3 CVEs
CVE-2026-25133
GHSA-gcqv-f29m-67gr
Apr 14, 2026
October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.
Impact
Stored XSS via malicious SVG files uploaded through the Media Manager
Could allow privilege escalation if a superuser views or embeds the malicious SVG
Requires authenticated backend access with media upload permissions (media.library.create)
SVG must be viewed or embedded in a page to trigger
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable SVG uploads by adding svg to the blocked extensions in media configuration
Set media.clean_vectors to true in configuration (enabled by default)
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-25125
GHSA-g6v3-wv4j-x9hg
Apr 14, 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.
Impact
Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
Could enable further attacks: database access, cookie forgery, AWS resource access
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Restrict Editor tool access to fully trusted administrators only
Ensure database and cloud service credentials are not accessible from the web server's network
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-22692
GHSA-m5qg-jc75-4jp6
Apr 14, 2026
October Rain has a Twig Sandbox Bypass via Collection Methods
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.
Impact
Bypass of Twig sandbox restrictions
Only affects installations with CMS_SAFE_MODE enabled (disabled by default)
Requires authenticated backend access with CMS template editing permissions
Patches
The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable CMS_SAFE_MODE if untrusted template editing is not required
Restrict CMS template editing permissions to fully trusted administrators only
References
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 346 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated Apr 14, 2026 · Source: OSV.dev
Sep 20, 2025
Released
Sep 20, 2025
Runtime
^8.0.2
Checksum
Dependencies
(9)
composer/composer
^2.0.0
doctrine/dbal
^2.13.3|^3.1.4
laravel/tinker
~2.0
league/csv
~9.1
linkorb/jsmin-php
~1.0
scssphp/scssphp
~1.0
symfony/yaml
^6.0
twig/twig
~3.0
+ 1 more
v4.0.11
patch
3 CVEs
CVE-2026-25133
GHSA-gcqv-f29m-67gr
Apr 14, 2026
October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.
Impact
Stored XSS via malicious SVG files uploaded through the Media Manager
Could allow privilege escalation if a superuser views or embeds the malicious SVG
Requires authenticated backend access with media upload permissions (media.library.create)
SVG must be viewed or embedded in a page to trigger
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable SVG uploads by adding svg to the blocked extensions in media configuration
Set media.clean_vectors to true in configuration (enabled by default)
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-25125
GHSA-g6v3-wv4j-x9hg
Apr 14, 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.
Impact
Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
Could enable further attacks: database access, cookie forgery, AWS resource access
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Restrict Editor tool access to fully trusted administrators only
Ensure database and cloud service credentials are not accessible from the web server's network
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-22692
GHSA-m5qg-jc75-4jp6
Apr 14, 2026
October Rain has a Twig Sandbox Bypass via Collection Methods
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.
Impact
Bypass of Twig sandbox restrictions
Only affects installations with CMS_SAFE_MODE enabled (disabled by default)
Requires authenticated backend access with CMS template editing permissions
Patches
The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable CMS_SAFE_MODE if untrusted template editing is not required
Restrict CMS template editing permissions to fully trusted administrators only
References
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 346 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated Apr 14, 2026 · Source: OSV.dev
Sep 08, 2025
Released
Sep 08, 2025
Checksum
v4.0.10
patch
3 CVEs
CVE-2026-25133
GHSA-gcqv-f29m-67gr
Apr 14, 2026
October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.
Impact
Stored XSS via malicious SVG files uploaded through the Media Manager
Could allow privilege escalation if a superuser views or embeds the malicious SVG
Requires authenticated backend access with media upload permissions (media.library.create)
SVG must be viewed or embedded in a page to trigger
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable SVG uploads by adding svg to the blocked extensions in media configuration
Set media.clean_vectors to true in configuration (enabled by default)
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-25125
GHSA-g6v3-wv4j-x9hg
Apr 14, 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.
Impact
Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
Could enable further attacks: database access, cookie forgery, AWS resource access
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Restrict Editor tool access to fully trusted administrators only
Ensure database and cloud service credentials are not accessible from the web server's network
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-22692
GHSA-m5qg-jc75-4jp6
Apr 14, 2026
October Rain has a Twig Sandbox Bypass via Collection Methods
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.
Impact
Bypass of Twig sandbox restrictions
Only affects installations with CMS_SAFE_MODE enabled (disabled by default)
Requires authenticated backend access with CMS template editing permissions
Patches
The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable CMS_SAFE_MODE if untrusted template editing is not required
Restrict CMS template editing permissions to fully trusted administrators only
References
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 346 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated Apr 14, 2026 · Source: OSV.dev
Aug 28, 2025
Released
Aug 28, 2025
Checksum
v4.0.7
patch
3 CVEs
CVE-2026-25133
GHSA-gcqv-f29m-67gr
Apr 14, 2026
October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.
Impact
Stored XSS via malicious SVG files uploaded through the Media Manager
Could allow privilege escalation if a superuser views or embeds the malicious SVG
Requires authenticated backend access with media upload permissions (media.library.create)
SVG must be viewed or embedded in a page to trigger
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable SVG uploads by adding svg to the blocked extensions in media configuration
Set media.clean_vectors to true in configuration (enabled by default)
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-25125
GHSA-g6v3-wv4j-x9hg
Apr 14, 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.
Impact
Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
Could enable further attacks: database access, cookie forgery, AWS resource access
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Restrict Editor tool access to fully trusted administrators only
Ensure database and cloud service credentials are not accessible from the web server's network
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-22692
GHSA-m5qg-jc75-4jp6
Apr 14, 2026
October Rain has a Twig Sandbox Bypass via Collection Methods
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.
Impact
Bypass of Twig sandbox restrictions
Only affects installations with CMS_SAFE_MODE enabled (disabled by default)
Requires authenticated backend access with CMS template editing permissions
Patches
The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable CMS_SAFE_MODE if untrusted template editing is not required
Restrict CMS template editing permissions to fully trusted administrators only
References
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 346 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated Apr 14, 2026 · Source: OSV.dev
Aug 04, 2025
Released
Aug 04, 2025
Checksum
v4.0.6
patch
3 CVEs
CVE-2026-25133
GHSA-gcqv-f29m-67gr
Apr 14, 2026
October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.
Impact
Stored XSS via malicious SVG files uploaded through the Media Manager
Could allow privilege escalation if a superuser views or embeds the malicious SVG
Requires authenticated backend access with media upload permissions (media.library.create)
SVG must be viewed or embedded in a page to trigger
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable SVG uploads by adding svg to the blocked extensions in media configuration
Set media.clean_vectors to true in configuration (enabled by default)
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-25125
GHSA-g6v3-wv4j-x9hg
Apr 14, 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.
Impact
Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
Could enable further attacks: database access, cookie forgery, AWS resource access
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Restrict Editor tool access to fully trusted administrators only
Ensure database and cloud service credentials are not accessible from the web server's network
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-22692
GHSA-m5qg-jc75-4jp6
Apr 14, 2026
October Rain has a Twig Sandbox Bypass via Collection Methods
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.
Impact
Bypass of Twig sandbox restrictions
Only affects installations with CMS_SAFE_MODE enabled (disabled by default)
Requires authenticated backend access with CMS template editing permissions
Patches
The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable CMS_SAFE_MODE if untrusted template editing is not required
Restrict CMS template editing permissions to fully trusted administrators only
References
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 346 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated Apr 14, 2026 · Source: OSV.dev
Jul 31, 2025
Released
Jul 31, 2025
Checksum
v4.0.3
patch
3 CVEs
CVE-2026-25133
GHSA-gcqv-f29m-67gr
Apr 14, 2026
October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.
Impact
Stored XSS via malicious SVG files uploaded through the Media Manager
Could allow privilege escalation if a superuser views or embeds the malicious SVG
Requires authenticated backend access with media upload permissions (media.library.create)
SVG must be viewed or embedded in a page to trigger
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable SVG uploads by adding svg to the blocked extensions in media configuration
Set media.clean_vectors to true in configuration (enabled by default)
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-25125
GHSA-g6v3-wv4j-x9hg
Apr 14, 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.
Impact
Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
Could enable further attacks: database access, cookie forgery, AWS resource access
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Restrict Editor tool access to fully trusted administrators only
Ensure database and cloud service credentials are not accessible from the web server's network
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-22692
GHSA-m5qg-jc75-4jp6
Apr 14, 2026
October Rain has a Twig Sandbox Bypass via Collection Methods
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.
Impact
Bypass of Twig sandbox restrictions
Only affects installations with CMS_SAFE_MODE enabled (disabled by default)
Requires authenticated backend access with CMS template editing permissions
Patches
The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable CMS_SAFE_MODE if untrusted template editing is not required
Restrict CMS template editing permissions to fully trusted administrators only
References
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 346 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated Apr 14, 2026 · Source: OSV.dev
Jul 23, 2025
Released
Jul 23, 2025
Checksum
v4.0.2
patch
3 CVEs
CVE-2026-25133
GHSA-gcqv-f29m-67gr
Apr 14, 2026
October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.
Impact
Stored XSS via malicious SVG files uploaded through the Media Manager
Could allow privilege escalation if a superuser views or embeds the malicious SVG
Requires authenticated backend access with media upload permissions (media.library.create)
SVG must be viewed or embedded in a page to trigger
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable SVG uploads by adding svg to the blocked extensions in media configuration
Set media.clean_vectors to true in configuration (enabled by default)
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-25125
GHSA-g6v3-wv4j-x9hg
Apr 14, 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.
Impact
Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
Could enable further attacks: database access, cookie forgery, AWS resource access
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Restrict Editor tool access to fully trusted administrators only
Ensure database and cloud service credentials are not accessible from the web server's network
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-22692
GHSA-m5qg-jc75-4jp6
Apr 14, 2026
October Rain has a Twig Sandbox Bypass via Collection Methods
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.
Impact
Bypass of Twig sandbox restrictions
Only affects installations with CMS_SAFE_MODE enabled (disabled by default)
Requires authenticated backend access with CMS template editing permissions
Patches
The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable CMS_SAFE_MODE if untrusted template editing is not required
Restrict CMS template editing permissions to fully trusted administrators only
References
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 346 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated Apr 14, 2026 · Source: OSV.dev
Jun 29, 2025
Released
Jun 29, 2025
Checksum
v4.0.1
patch
3 CVEs
CVE-2026-25133
GHSA-gcqv-f29m-67gr
Apr 14, 2026
October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.
Impact
Stored XSS via malicious SVG files uploaded through the Media Manager
Could allow privilege escalation if a superuser views or embeds the malicious SVG
Requires authenticated backend access with media upload permissions (media.library.create)
SVG must be viewed or embedded in a page to trigger
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable SVG uploads by adding svg to the blocked extensions in media configuration
Set media.clean_vectors to true in configuration (enabled by default)
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-25125
GHSA-g6v3-wv4j-x9hg
Apr 14, 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.
Impact
Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
Could enable further attacks: database access, cookie forgery, AWS resource access
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Restrict Editor tool access to fully trusted administrators only
Ensure database and cloud service credentials are not accessible from the web server's network
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-22692
GHSA-m5qg-jc75-4jp6
Apr 14, 2026
October Rain has a Twig Sandbox Bypass via Collection Methods
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.
Impact
Bypass of Twig sandbox restrictions
Only affects installations with CMS_SAFE_MODE enabled (disabled by default)
Requires authenticated backend access with CMS template editing permissions
Patches
The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable CMS_SAFE_MODE if untrusted template editing is not required
Restrict CMS template editing permissions to fully trusted administrators only
References
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 346 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated Apr 14, 2026 · Source: OSV.dev
Jun 17, 2025
Released
Jun 17, 2025
Checksum
v4.0.0
major
3 CVEs
CVE-2026-25133
GHSA-gcqv-f29m-67gr
Apr 14, 2026
October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.
Impact
Stored XSS via malicious SVG files uploaded through the Media Manager
Could allow privilege escalation if a superuser views or embeds the malicious SVG
Requires authenticated backend access with media upload permissions (media.library.create)
SVG must be viewed or embedded in a page to trigger
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable SVG uploads by adding svg to the blocked extensions in media configuration
Set media.clean_vectors to true in configuration (enabled by default)
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-25125
GHSA-g6v3-wv4j-x9hg
Apr 14, 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.
Impact
Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
Could enable further attacks: database access, cookie forgery, AWS resource access
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Restrict Editor tool access to fully trusted administrators only
Ensure database and cloud service credentials are not accessible from the web server's network
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-22692
GHSA-m5qg-jc75-4jp6
Apr 14, 2026
October Rain has a Twig Sandbox Bypass via Collection Methods
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.
Impact
Bypass of Twig sandbox restrictions
Only affects installations with CMS_SAFE_MODE enabled (disabled by default)
Requires authenticated backend access with CMS template editing permissions
Patches
The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable CMS_SAFE_MODE if untrusted template editing is not required
Restrict CMS template editing permissions to fully trusted administrators only
References
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 346 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated Apr 14, 2026 · Source: OSV.dev
Jun 14, 2025
Released
Jun 14, 2025
Checksum
v3.7.12
patch
3 CVEs
CVE-2026-25133
GHSA-gcqv-f29m-67gr
Apr 14, 2026
October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.
Impact
Stored XSS via malicious SVG files uploaded through the Media Manager
Could allow privilege escalation if a superuser views or embeds the malicious SVG
Requires authenticated backend access with media upload permissions (media.library.create)
SVG must be viewed or embedded in a page to trigger
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable SVG uploads by adding svg to the blocked extensions in media configuration
Set media.clean_vectors to true in configuration (enabled by default)
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-25125
GHSA-g6v3-wv4j-x9hg
Apr 14, 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.
Impact
Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
Could enable further attacks: database access, cookie forgery, AWS resource access
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Restrict Editor tool access to fully trusted administrators only
Ensure database and cloud service credentials are not accessible from the web server's network
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-22692
GHSA-m5qg-jc75-4jp6
Apr 14, 2026
October Rain has a Twig Sandbox Bypass via Collection Methods
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.
Impact
Bypass of Twig sandbox restrictions
Only affects installations with CMS_SAFE_MODE enabled (disabled by default)
Requires authenticated backend access with CMS template editing permissions
Patches
The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable CMS_SAFE_MODE if untrusted template editing is not required
Restrict CMS template editing permissions to fully trusted administrators only
References
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 346 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated Apr 14, 2026 · Source: OSV.dev
May 16, 2025
Released
May 16, 2025
Checksum
v3.7.11
patch
3 CVEs
CVE-2026-25133
GHSA-gcqv-f29m-67gr
Apr 14, 2026
October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.
Impact
Stored XSS via malicious SVG files uploaded through the Media Manager
Could allow privilege escalation if a superuser views or embeds the malicious SVG
Requires authenticated backend access with media upload permissions (media.library.create)
SVG must be viewed or embedded in a page to trigger
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable SVG uploads by adding svg to the blocked extensions in media configuration
Set media.clean_vectors to true in configuration (enabled by default)
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-25125
GHSA-g6v3-wv4j-x9hg
Apr 14, 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.
Impact
Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
Could enable further attacks: database access, cookie forgery, AWS resource access
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Restrict Editor tool access to fully trusted administrators only
Ensure database and cloud service credentials are not accessible from the web server's network
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-22692
GHSA-m5qg-jc75-4jp6
Apr 14, 2026
October Rain has a Twig Sandbox Bypass via Collection Methods
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.
Impact
Bypass of Twig sandbox restrictions
Only affects installations with CMS_SAFE_MODE enabled (disabled by default)
Requires authenticated backend access with CMS template editing permissions
Patches
The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable CMS_SAFE_MODE if untrusted template editing is not required
Restrict CMS template editing permissions to fully trusted administrators only
References
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 346 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated Apr 14, 2026 · Source: OSV.dev
Feb 19, 2025
Released
Feb 19, 2025
Checksum
v3.7.8
patch
3 CVEs
CVE-2026-25133
GHSA-gcqv-f29m-67gr
Apr 14, 2026
October Rain has Stored XSS via SVG Filter Bypass
A stored cross-site scripting (XSS) vulnerability was identified in the SVG sanitization logic. The regex pattern used to strip on* event handler attributes could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries.
Impact
Stored XSS via malicious SVG files uploaded through the Media Manager
Could allow privilege escalation if a superuser views or embeds the malicious SVG
Requires authenticated backend access with media upload permissions (media.library.create)
SVG must be viewed or embedded in a page to trigger
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable SVG uploads by adding svg to the blocked extensions in media configuration
Set media.clean_vectors to true in configuration (enabled by default)
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-25125
GHSA-g6v3-wv4j-x9hg
Apr 14, 2026
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.
Impact
Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
Could enable further attacks: database access, cookie forgery, AWS resource access
Requires authenticated backend access with Editor permissions
Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)
Patches
The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Restrict Editor tool access to fully trusted administrators only
Ensure database and cloud service credentials are not accessible from the web server's network
References
Reported by Pentest-Tools.com
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 350 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v4.1.5
v4.1.6
v4.1.9
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.13
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated May 08, 2026 · Source: OSV.dev
CVE-2026-22692
GHSA-m5qg-jc75-4jp6
Apr 14, 2026
October Rain has a Twig Sandbox Bypass via Collection Methods
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.
Impact
Bypass of Twig sandbox restrictions
Only affects installations with CMS_SAFE_MODE enabled (disabled by default)
Requires authenticated backend access with CMS template editing permissions
Patches
The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
Disable CMS_SAFE_MODE if untrusted template editing is not required
Restrict CMS template editing permissions to fully trusted administrators only
References
Affected versions
v4.0.0
v4.0.1
v4.0.10
v4.0.11
v4.0.12
v4.0.13
v4.0.16
v4.0.2
v4.0.20
v4.0.22
v4.0.3
v4.0.6
+ 346 more
Show less
v4.0.7
v4.1.0
v4.1.1
v4.1.4
v1.0.319
v1.0.320
v1.0.321
v1.0.322
v1.0.323
v1.0.324
v1.0.325
v1.0.326
v1.0.327
v1.0.328
v1.0.329
v1.0.330
v1.0.331
v1.0.332
v1.0.333
v1.0.334
v1.0.335
v1.0.336
v1.0.337
v1.0.338
v1.0.339
v1.0.340
v1.0.341
v1.0.342
v1.0.343
v1.0.344
v1.0.345
v1.0.346
v1.0.347
v1.0.348
v1.0.349
v1.0.350
v1.0.351
v1.0.352
v1.0.353
v1.0.354
v1.0.355
v1.0.356
v1.0.357
v1.0.358
v1.0.359
v1.0.360
v1.0.361
v1.0.362
v1.0.363
v1.0.364
v1.0.365
v1.0.366
v1.0.367
v1.0.368
v1.0.369
v1.0.370
v1.0.371
v1.0.372
v1.0.373
v1.0.374
v1.0.375
v1.0.376
v1.0.377
v1.0.378
v1.0.379
v1.0.380
v1.0.381
v1.0.382
v1.0.383
v1.0.384
v1.0.385
v1.0.386
v1.0.387
v1.0.388
v1.0.389
v1.0.390
v1.0.391
v1.0.392
v1.0.393
v1.0.394
v1.0.395
v1.0.396
v1.0.397
v1.0.398
v1.0.399
v1.0.400
v1.0.401
v1.0.402
v1.0.403
v1.0.404
v1.0.405
v1.0.406
v1.0.407
v1.0.408
v1.0.409
v1.0.410
v1.0.411
v1.0.412
v1.0.413
v1.0.414
v1.0.415
v1.0.416
v1.0.417
v1.0.418
v1.0.419
v1.0.420
v1.0.421
v1.0.422
v1.0.423
v1.0.424
v1.0.425
v1.0.426
v1.0.427
v1.0.428
v1.0.429
v1.0.430
v1.0.431
v1.0.432
v1.0.433
v1.0.434
v1.0.435
v1.0.436
v1.0.437
v1.0.438
v1.0.439
v1.0.440
v1.0.441
v1.0.442
v1.0.443
v1.0.444
v1.0.445
v1.0.446
v1.0.447
v1.0.448
v1.0.449
v1.0.450
v1.0.451
v1.0.452
v1.0.453
v1.0.454
v1.0.455
v1.0.456
v1.0.457
v1.0.458
v1.0.459
v1.0.460
v1.0.461
v1.0.462
v1.0.463
v1.0.464
v1.0.465
v1.0.466
v1.0.467
v1.0.468
v1.0.469
v1.0.470
v1.0.471
v1.0.472
v1.0.473
v1.0.474
v1.0.476
v1.1.0
v1.1.1
v1.1.10
v1.1.12
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.7
v1.1.8
v1.1.9
v2.0.0
v2.0.13
v2.0.18
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.25
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.11
v2.1.12
v2.1.20
v2.1.21
v2.1.22
v2.1.23
v2.1.24
v2.1.25
v2.1.27
v2.1.28
v2.1.29
v2.1.3
v2.1.32
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.10
v2.2.11
v2.2.15
v2.2.17
v2.2.18
v2.2.19
v2.2.25
v2.2.26
v2.2.27
v2.2.28
v2.2.30
v2.2.32
v2.2.34
v2.2.4
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v3.0.0
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.17
v3.0.2
v3.0.21
v3.0.22
v3.0.30
v3.0.36
v3.0.37
v3.0.38
v3.0.4
v3.0.41
v3.0.42
v3.0.43
v3.0.44
v3.0.5
v3.0.55
v3.0.56
v3.0.57
v3.0.58
v3.0.59
v3.0.6
v3.0.61
v3.0.64
v3.0.65
v3.0.66
v3.0.67
v3.0.7
v3.0.73
v3.0.74
v3.0.75
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.12
v3.1.14
v3.1.18
v3.1.19
v3.1.20
v3.1.22
v3.1.23
v3.1.25
v3.1.26
v3.1.27
v3.1.28
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.1.9
v3.2.0
v3.2.11
v3.2.12
v3.2.13
v3.2.14
v3.2.15
v3.2.16
v3.2.20
v3.2.22
v3.2.23
v3.2.8
v3.3.0
v3.3.10
v3.3.12
v3.3.14
v3.3.15
v3.3.18
v3.3.3
v3.3.7
v3.3.9
v3.4.0
v3.4.10
v3.4.11
v3.4.12
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.3
v3.4.7
v3.4.9
v3.5.0
v3.5.1
v3.5.10
v3.5.13
v3.5.2
v3.5.6
v3.5.8
v3.5.9
v3.6.0
v3.6.1
v3.6.11
v3.6.12
v3.6.14
v3.6.15
v3.6.16
v3.6.18
v3.6.19
v3.6.20
v3.6.22
v3.6.23
v3.6.25
v3.6.28
v3.6.30
v3.6.4
v3.6.7
v3.6.8
v3.6.9
v3.7.0
v3.7.11
v3.7.12
v3.7.3
v3.7.4
v3.7.5
v3.7.7
v3.7.8
Updated Apr 14, 2026 · Source: OSV.dev
Jan 07, 2025
Released
Jan 07, 2025
Checksum
View on Github