UpHeron
All vulnerabilities

Servers and applications

CVE-2022-21705

Authenticated remote code execution

Severity
High 7.2
Published
23 Feb 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.0.474, 1.1.10, 2.1.27
Also known as
GHSA-79jw-2f46-wv22
Sources
NVD, Project advisories (GitHub)

Description

Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass `cms.safe_mode` / `cms.enableSafeMode` in order to execute arbitrary code. This issue only affects admin panels that…

Affected software

SoftwareAffected versions
October CMSServers and applications · cpe:a:octobercms:october
  • Every version before 1.0.474
  • From 1.1.0 before 1.1.10
  • From 2.0.0 before 2.1.27
October CMSServers and applications · github:octobercms/october
  • Version 1.0.473
  • Version 1.1.9
  • Version 2.1.26

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-21705
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-21705
  • GitHub Advisory Database https://github.com/advisories/GHSA-79jw-2f46-wv22
  • github.com https://github.com/octobercms/october/security/advisories/GHSA-79jw-2f46-wv22