CVE-2022-21705

Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass `cms.safe_mode` / `cms.enableSafeMode` in order to execute arbitrary code. This issue only affects admin panels that rely on safe mode and restricted permissions. To exploit this vulnerability, an attacker must first have access to the backend area. The issue has been patched in Build 474 (v1.0.474) and v1.1.10. Users unable to upgrade should apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually.

• CWE-74

• https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fePatch, Third Party Advisory
• https://github.com/octobercms/october/security/advisories/GHSA-79jw-2f46-wv22Issue Tracking, Patch, Third Party Advisory
• https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fePatch, Third Party Advisory
• https://github.com/octobercms/october/security/advisories/GHSA-79jw-2f46-wv22Issue Tracking, Patch, Third Party Advisory

Published

Feb 23, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-2170The Microsoft Advertising Universal Event Tracking (UET) Wor…4.8
• CVE-2022-21700Micronaut is a JVM-based, full stack Java framework designed…5.3
• CVE-2022-21701Istio is an open platform to connect, manage, and secure mic…8.8
• CVE-2022-21702Grafana is an open-source platform for monitoring and observ…5.4
• CVE-2022-21703Grafana is an open-source platform for monitoring and observ…8.8
• CVE-2022-21704log4js-node is a port of log4js to node.js. In affected vers…5.5
• CVE-2022-21706Zulip is an open-source team collaboration tool with topic-b…9.8
• CVE-2022-21707wasmCloud Host Runtime is a server process that securely hos…8.1
• CVE-2022-21708graphql-go is a GraphQL server with a focus on ease of use. …6.5
• CVE-2022-2171The Progressive License WordPress plugin through 1.1.0 is la…5.4
• CVE-2022-21710ShortDescription is a MediaWiki extension that provides loca…6.1
• CVE-2022-21711elfspirit is an ELF static analysis and injection framework …7.1