UpHeron
All vulnerabilities

Servers and applications

CVE-2021-21264

Bypass of fix for CVE-2020-26231, Twig sandbox escape

Severity
Medium 5.2
Published
2 May 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Also known as
GHSA-fcr8-6q7r-m4wg
Sources
NVD, Project advisories (GitHub)

Description

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-26231 (fixed in 1.0.470/471 and 1.1.1) was discovered that has the same impact as CVE-2020-26231 & CVE-2020-15247. An authenticated backend user with the `cms.manage_pages`, `cms.manage_layouts`, or `cms.manage_partials` permissions who would **normally** not be permitted to provide…

Affected software

SoftwareAffected versions
October CMSServers and applications · cpe:a:octobercms:october
  • Every version up to 1.0.471
  • From 1.1.0 up to 1.1.1
October CMSServers and applications · github:octobercms/october
  • Version 1.0.471
  • Version 1.1.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-21264
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-21264
  • GitHub Advisory Database https://github.com/advisories/GHSA-fcr8-6q7r-m4wg
  • github.com https://github.com/octobercms/october/security/advisories/GHSA-fcr8-6q7r-m4wg