UpHeron
All vulnerabilities

Servers and applications

CVE-2020-15247

Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.

Severity
Medium 5.2
Published
22 Nov 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.0.469
Also known as
GHSA-94vp-rmqv-5875
Sources
NVD, Project advisories (GitHub)

Description

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, an authenticated backend user with the cms.manage_pages, cms.manage_layouts, or cms.manage_partials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to cms.enableSafeMode being enabled is able…

Affected software

SoftwareAffected versions
October CMSServers and applications · cpe:a:octobercms:october
  • From 1.0.319 before 1.0.469
October CMSServers and applications · github:octobercms/october
  • From 1.0.319 before 1.0.469

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-15247
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-15247
  • GitHub Advisory Database https://github.com/advisories/GHSA-94vp-rmqv-5875
  • github.com https://github.com/octobercms/october/security/advisories/GHSA-94vp-rmqv-5875