CVE-2020-26231

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-15247 (fixed in 1.0.469 and 1.1.0) was discovered that has the same impact as CVE-2020-15247. An authenticated backend user with the cms.manage_pages, cms.manage_layouts, or cms.manage_partials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to cms.enableSafeMode being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This is not a problem for anyone that trusts their users with those permissions to normally write & manage PHP within the CMS by not having cms.enableSafeMode enabled, but would be a problem for anyone relying on cms.enableSafeMode to ensure that users with those permissions in production do not have access to write & execute arbitrary PHP. Issue has been patched in Build 470 (v1.0.470) and v1.1.1.

• CWE-862

• https://github.com/octobercms/october/commit/d34fb8ab51108495a9a651b841202d935f4e12f7Patch, Third Party Advisory
• https://github.com/octobercms/october/security/advisories/GHSA-r89v-cgv7-3jhxPatch, Third Party Advisory
• https://github.com/octobercms/october/commit/d34fb8ab51108495a9a651b841202d935f4e12f7Patch, Third Party Advisory
• https://github.com/octobercms/october/security/advisories/GHSA-r89v-cgv7-3jhxPatch, Third Party Advisory

Published

Nov 23, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26226In the npm package semantic-release before version 17.2.3, s…8.1
• CVE-2020-26227TYPO3 is an open source PHP based web content management sys…6.1
• CVE-2020-26228TYPO3 is an open source PHP based web content management sys…7.5
• CVE-2020-26229TYPO3 is an open source PHP based web content management sys…3.7
• CVE-2020-2623Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26230Radar COVID is the official COVID-19 exposure notification a…5.3
• CVE-2020-26232Jupyter Server before version 1.0.6 has an Open redirect vul…5.4
• CVE-2020-26233Git Credential Manager Core (GCM Core) is a secure Git crede…7.3
• CVE-2020-26234Opencast before versions 8.9 and 7.9 disables HTTPS hostname…4.8
• CVE-2020-26235In Rust time crate from version 0.2.7 and before version 0.2…5.3
• CVE-2020-26236In ScratchVerifier before commit a603769, an attacker can hi…7.5
• CVE-2020-26237Highlight.js is a syntax highlighter written in JavaScript. …8.7