CVE-2026-26274
Last modified
CVE-2026-26274 is a medium-severity vulnerability rated 6.6/10 on the CVSS scale. October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a vulnerability was identified in the Twig sandbox security policy that allowed database write operations when cms.safe_mode is enabled. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a vulnerability was identified in the Twig sandbox security policy that allowed database write operations when cms.safe_mode is enabled. Backend users with Developer permissions could use Twig template markup to execute insert, update, and delete operations on any database table through the query builder, which is included in the sandbox allow-list. This vulnerability is fixed in 3.7.14 and 4.1.10.
Metrics
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-26274?
How severe is CVE-2026-26274?
How do I fix CVE-2026-26274?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-26269Vim is an open source, command line text editor. Prior to 9.…7.5
- CVE-2026-2627A security flaw has been discovered in Softland FBackup up t…7.8
- CVE-2026-26270InvoicePlane is a self-hosted open source application for ma…5.4
- CVE-2026-26271FreeRDP is a free implementation of the Remote Desktop Proto…5.3
- CVE-2026-26272HomeBox is a home inventory and organization system. Prior t…5.4
- CVE-2026-26273Known is a social publishing platform. Prior to 1.6.3, a Cri…9.8
- CVE-2026-26275httpsig-hyper is a hyper extension for http message signatur…7.5
- CVE-2026-26276Gogs is an open source self-hosted Git service. Prior to ver…5.4
- CVE-2026-26278fast-xml-parser allows users to validate XML, parse XML to J…7.5
- CVE-2026-26279Froxlor is open source server administration software. Prior…9.1
- CVE-2026-2628The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login…9.8
- CVE-2026-26280systeminformation is a System and OS information library for…7.8
Are you affected by CVE-2026-26274?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST