What is GHSA-m5qg-jc75-4jp6?

GHSA-m5qg-jc75-4jp6 is a security advisory published by GitHub Security Advisories with Medium severity. October Rain has a Twig Sandbox Bypass via Collection Methods

Which CVE IDs does GHSA-m5qg-jc75-4jp6 cover?

GHSA-m5qg-jc75-4jp6 covers the following CVE IDs: CVE-2026-22692. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m5qg-jc75-4jp6?

GHSA-m5qg-jc75-4jp6 has a CVSS v3 base score of 4.9, published by GitHub Security Advisories.

Which products are affected by GHSA-m5qg-jc75-4jp6?

GHSA-m5qg-jc75-4jp6 affects 2 products, including: composer/october/rain:\u003e= 4.0.0, \u003c= 4.1.4; composer/october/rain:\u003c= 3.7.12.

GHSA-m5qg-jc75-4jp6MediumCVSS 4.9

October Rain has a Twig Sandbox Bypass via Collection Methods

Vendor

GitHub Security Advisories

Published

April 14, 2026

Last Modified

April 14, 2026

🔗 CVE IDs covered (1)

CVE-2026-22692 →

📋 Description

A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.

Impact

Bypass of Twig sandbox restrictions
Only affects installations with CMS_SAFE_MODE enabled (disabled by default)
Requires authenticated backend access with CMS template editing permissions

Patches

The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.

Workarounds

If upgrading immediately is not possible:

Disable CMS_SAFE_MODE if untrusted template editing is not required
Restrict CMS template editing permissions to fully trusted administrators only

References

Reported by Łukasz Rybak

🎯 Affected products2

composer/october/rain:>= 4.0.0, <= 4.1.4
composer/october/rain:<= 3.7.12