Server Side Template Injection

October CMS is vulnerable to Server Side Template Injection. The vulnerability is due improper sandboxing of twig code, where an authenticated backend user possessing the editor.cms_pages, editor.cms_layouts, or editor.cms_partials permissions, can execute PHP code even when cms.safe_mode being enabled. This issue can be exploited by an attacker via crafting malicious Twig code to escape sandbox resulting in execution of arbitrary PHP code.