CVE-2022-21705
Authenticated remote code execution in octobercms
Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass cms.safe_mode / cms.enableSafeMode in order to execute arbitrary code. This issue only affects admin panels that rely on safe mode and restricted permissions. To exploit this vulnerability, an attacker must first have access to the backend area. The issue has been patched in Build 474 (v1.0.474) and v1.1.10. Users unable to upgrade should apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Authenticated remote code execution in octobercms
Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass cms.safe_mode / cms.enableSafeMode in order to execute arbitrary code. This issue only affects admin panels that rely on safe mode and restricted permissions. To exploit this vulnerability, an attacker must first have access to the backend area. The issue has been patched in Build 474 (v1.0.474) and v1.1.10. Users unable to upgrade should apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually.
- Record
CVE-2022-21705- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
EUVDEUVD-2022-0885
Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass cms.safe_mode / cms.enableSafeMode in order to execute arbitrary code. This issue only affects admin panels that rely on safe mode and restricted permissions. To exploit this vulnerability, an attacker must first have access to the backend area. The issue has been patched in Build 474 (v1.0.474) and v1.1.10. Users unable to upgrade should apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually.
- Record
EUVD-2022-0885- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-79jw-2f46-wv22
Authenticated remote code execution in October CMS
Impact
An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass cms.safe_mode / cms.enableSafeMode in order to execute arbitrary code.
- This issue only affects admin panels that rely on safe mode and restricted permissions.
- To exploit this vulnerability, an attacker must first have access to the backend area.
Patches
The issue has been patched in Build 474 (v1.0.474) and v1.1.10.
Workarounds
Apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually if unable to upgrade to Build 474 or v1.1.10.
References
Credits to:
- David Miller
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected]
- Record
GHSA-79jw-2f46-wv22- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
NVD
Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass cms.safe_mode / cms.enableSafeMode in order to execute arbitrary code. This issue only affects admin panels that rely on safe mode and restricted permissions. To exploit this vulnerability, an attacker must first have access to the backend area. The issue has been patched in Build 474 (v1.0.474) and v1.1.10. Users unable to upgrade should apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually.
- Record
CVE-2022-21705- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 8.5 High
AV:N/AC:M/Au:S/C:C/I:C/A:C - Weakness
- CWE-74
- Updated
- 2026-11-02
OSV
Authenticated remote code execution in octobercms
Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass cms.safe_mode / cms.enableSafeMode in order to execute arbitrary code. This issue only affects admin panels that rely on safe mode and restricted permissions. To exploit this vulnerability, an attacker must first have access to the backend area. The issue has been patched in Build 474 (v1.0.474) and v1.1.10. Users unable to upgrade should apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually.
- Record
CVE-2022-21705- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
OSVGHSA-79jw-2f46-wv22
Authenticated remote code execution in October CMS
Impact
An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass cms.safe_mode / cms.enableSafeMode in order to execute arbitrary code.
- This issue only affects admin panels that rely on safe mode and restricted permissions.
- To exploit this vulnerability, an attacker must first have access to the backend area.
Patches
The issue has been patched in Build 474 (v1.0.474) and v1.1.10.
Workarounds
Apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually if unable to upgrade to Build 474 or v1.1.10.
References
Credits to:
- David Miller
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected]
- Record
GHSA-79jw-2f46-wv22- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
october/systemPackagist |
before 1.0.474 | 1.0.474 |
october/systemPackagist |
1.1.0 up to 1.1.10 | 1.1.10 |
october/systemPackagist |
2.0.0 up to 2.1.27 | 2.1.27 |
october/systemPackagist |
before 1.0.474, plus listed versions v1.0.319v1.0.320v1.0.321v1.0.322v1.0.323 Show 45 moreShow lessv1.0.324v1.0.325v1.0.326v1.0.327v1.0.328v1.0.329v1.0.330v1.0.331v1.0.332v1.0.333v1.0.334v1.0.335v1.0.336v1.0.337v1.0.338v1.0.339v1.0.340v1.0.341v1.0.342v1.0.343v1.0.344v1.0.345v1.0.346v1.0.347v1.0.348v1.0.349v1.0.350v1.0.351v1.0.352v1.0.353v1.0.354v1.0.355v1.0.356v1.0.357v1.0.358v1.0.359v1.0.360v1.0.361v1.0.362v1.0.363v1.0.364v1.0.365v1.0.366v1.0.367v1.0.368 |
1.0.474 |
october/systemPackagist |
1.1.0 up to 1.1.10, plus listed versions v1.1.0v1.1.1v1.1.2v1.1.3v1.1.4v1.1.5v1.1.6v1.1.9 |
1.1.10 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | October CMS - Remote Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-21705 is a high vulnerability (CVSS 7.2) in Octobercms October, published February 23, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.65%, the 95th percentile. Fixed in october/system 1.0.474.
References
github.com/octobercms/october/security/advisories/GHSA-79jw-2f46-wv22
nvd.nist.gov/vuln/detail/CVE-2022-21705
Left out here: 105 versions. The JSON record has them.