UpHeron
All vulnerabilities

Servers and applications

CVE-2022-35944

Safe Mode bypass leads to authenticated Remote Code Execution

Severity
High 7.2
Published
13 Oct 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.2.34, 3.0.66
Also known as
GHSA-x4q7-m6fp-4v9v
Sources
NVD, Project advisories (GitHub)

Description

October is a self-hosted Content Management System (CMS) platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin panel and permission to open the "Editor" section, they can bypass the Safe Mode (`cms.safe_mode`)…

Affected software

SoftwareAffected versions
October CMSServers and applications · cpe:a:octobercms:october
  • Every version before 2.2.34
  • From 3.0.00 before 3.0.66
October CMSServers and applications · github:octobercms/october
  • From 3.0 before 3.0.66

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-35944
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-35944
  • GitHub Advisory Database https://github.com/advisories/GHSA-x4q7-m6fp-4v9v
  • github.com https://github.com/octobercms/october/security/advisories/GHSA-x4q7-m6fp-4v9v