October Rain has a Twig Sandbox Bypass via Collection Methods
The advisory, in context
A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.
Impact
- Bypass of Twig sandbox restrictions
- Only affects installations with
CMS_SAFE_MODEenabled (disabled by default) - Requires authenticated backend access with CMS template editing permissions
Patches
The vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.
Workarounds
If upgrading immediately is not possible:
- Disable
CMS_SAFE_MODEif untrusted template editing is not required - Restrict CMS template editing permissions to fully trusted administrators only
References
- Reported by Łukasz Rybak
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 4.0.0 before 4.1.5
Fixed in 4.1.5
16 explicitly affected versions
v4.0.0, v4.0.1, v4.0.10, v4.0.11, v4.0.12, v4.0.13, v4.0.16, v4.0.2, v4.0.20, v4.0.22, v4.0.3, v4.0.6, v4.0.7, v4.1.0, v4.1.1, v4.1.4
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.1.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v4.0.0",
"v4.0.1",
"v4.0.10",
"v4.0.11",
"v4.0.12",
"v4.0.13",
"v4.0.16",
"v4.0.2",
"v4.0.20",
"v4.0.22",
"v4.0.3",
"v4.0.6",
"v4.0.7",
"v4.1.0",
"v4.1.1",
"v4.1.4"
]
}Earlier releases before 3.7.13
Fixed in 3.7.13
342 explicitly affected versions
v1.0.319, v1.0.320, v1.0.321, v1.0.322, v1.0.323, v1.0.324, v1.0.325, v1.0.326, v1.0.327, v1.0.328, v1.0.329, v1.0.330, v1.0.331, v1.0.332, v1.0.333, v1.0.334, v1.0.335, v1.0.336, v1.0.337, v1.0.338, v1.0.339, v1.0.340, v1.0.341, v1.0.342, v1.0.343, v1.0.344, v1.0.345, v1.0.346, v1.0.347, v1.0.348, v1.0.349, v1.0.350, v1.0.351, v1.0.352, v1.0.353, v1.0.354, v1.0.355, v1.0.356, v1.0.357, v1.0.358, v1.0.359, v1.0.360, v1.0.361, v1.0.362, v1.0.363, v1.0.364, v1.0.365, v1.0.366, v1.0.367, v1.0.368, v1.0.369, v1.0.370, v1.0.371, v1.0.372, v1.0.373, v1.0.374, v1.0.375, v1.0.376, v1.0.377, v1.0.378, v1.0.379, v1.0.380, v1.0.381, v1.0.382, v1.0.383, v1.0.384, v1.0.385, v1.0.386, v1.0.387, v1.0.388, v1.0.389, v1.0.390, v1.0.391, v1.0.392, v1.0.393, v1.0.394, v1.0.395, v1.0.396, v1.0.397, v1.0.398, v1.0.399, v1.0.400, v1.0.401, v1.0.402, v1.0.403, v1.0.404, v1.0.405, v1.0.406, v1.0.407, v1.0.408, v1.0.409, v1.0.410, v1.0.411, v1.0.412, v1.0.413, v1.0.414, v1.0.415, v1.0.416, v1.0.417, v1.0.418, v1.0.419, v1.0.420, v1.0.421, v1.0.422, v1.0.423, v1.0.424, v1.0.425, v1.0.426, v1.0.427, v1.0.428, v1.0.429, v1.0.430, v1.0.431, v1.0.432, v1.0.433, v1.0.434, v1.0.435, v1.0.436, v1.0.437, v1.0.438, v1.0.439, v1.0.440, v1.0.441, v1.0.442, v1.0.443, v1.0.444, v1.0.445, v1.0.446, v1.0.447, v1.0.448, v1.0.449, v1.0.450, v1.0.451, v1.0.452, v1.0.453, v1.0.454, v1.0.455, v1.0.456, v1.0.457, v1.0.458, v1.0.459, v1.0.460, v1.0.461, v1.0.462, v1.0.463, v1.0.464, v1.0.465, v1.0.466, v1.0.467, v1.0.468, v1.0.469, v1.0.470, v1.0.471, v1.0.472, v1.0.473, v1.0.474, v1.0.476, v1.1.0, v1.1.1, v1.1.10, v1.1.12, v1.1.2, v1.1.3, v1.1.4, v1.1.5, v1.1.7, v1.1.8, v1.1.9, v2.0.0, v2.0.13, v2.0.18, v2.0.20, v2.0.21, v2.0.22, v2.0.23, v2.0.25, v2.0.27, v2.0.28, v2.0.29, v2.0.3, v2.0.4, v2.0.5, v2.1.0, v2.1.1, v2.1.11, v2.1.12, v2.1.20, v2.1.21, v2.1.22, v2.1.23, v2.1.24, v2.1.25, v2.1.27, v2.1.28, v2.1.29, v2.1.3, v2.1.32, v2.1.5, v2.1.6, v2.1.7, v2.1.8, v2.2.0, v2.2.10, v2.2.11, v2.2.15, v2.2.17, v2.2.18, v2.2.19, v2.2.25, v2.2.26, v2.2.27, v2.2.28, v2.2.30, v2.2.32, v2.2.34, v2.2.4, v2.2.6, v2.2.7, v2.2.8, v2.2.9, v3.0.0, v3.0.1, v3.0.10, v3.0.12, v3.0.13, v3.0.14, v3.0.17, v3.0.2, v3.0.21, v3.0.22, v3.0.30, v3.0.36, v3.0.37, v3.0.38, v3.0.4, v3.0.41, v3.0.42, v3.0.43, v3.0.44, v3.0.5, v3.0.55, v3.0.56, v3.0.57, v3.0.58, v3.0.59, v3.0.6, v3.0.61, v3.0.64, v3.0.65, v3.0.66, v3.0.67, v3.0.7, v3.0.73, v3.0.74, v3.0.75, v3.0.9, v3.1.0, v3.1.1, v3.1.10, v3.1.12, v3.1.14, v3.1.18, v3.1.19, v3.1.20, v3.1.22, v3.1.23, v3.1.25, v3.1.26, v3.1.27, v3.1.28, v3.1.3, v3.1.4, v3.1.5, v3.1.7, v3.1.9, v3.2.0, v3.2.11, v3.2.12, v3.2.13, v3.2.14, v3.2.15, v3.2.16, v3.2.20, v3.2.22, v3.2.23, v3.2.8, v3.3.0, v3.3.10, v3.3.12, v3.3.14, v3.3.15, v3.3.18, v3.3.3, v3.3.7, v3.3.9, v3.4.0, v3.4.10, v3.4.11, v3.4.12, v3.4.14, v3.4.15, v3.4.16, v3.4.17, v3.4.18, v3.4.3, v3.4.7, v3.4.9, v3.5.0, v3.5.1, v3.5.10, v3.5.13, v3.5.2, v3.5.6, v3.5.8, v3.5.9, v3.6.0, v3.6.1, v3.6.11, v3.6.12, v3.6.14, v3.6.15, v3.6.16, v3.6.18, v3.6.19, v3.6.20, v3.6.22, v3.6.23, v3.6.25, v3.6.28, v3.6.30, v3.6.4, v3.6.7, v3.6.8, v3.6.9, v3.7.0, v3.7.11, v3.7.12, v3.7.3, v3.7.4, v3.7.5, v3.7.7, v3.7.8
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.13"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v1.0.319",
"v1.0.320",
"v1.0.321",
"v1.0.322",
"v1.0.323",
"v1.0.324",
"v1.0.325",
"v1.0.326",
"v1.0.327",
"v1.0.328",
"v1.0.329",
"v1.0.330",
"v1.0.331",
"v1.0.332",
"v1.0.333",
"v1.0.334",
"v1.0.335",
"v1.0.336",
"v1.0.337",
"v1.0.338",
"v1.0.339",
"v1.0.340",
"v1.0.341",
"v1.0.342",
"v1.0.343",
"v1.0.344",
"v1.0.345",
"v1.0.346",
"v1.0.347",
"v1.0.348",
"v1.0.349",
"v1.0.350",
"v1.0.351",
"v1.0.352",
"v1.0.353",
"v1.0.354",
"v1.0.355",
"v1.0.356",
"v1.0.357",
"v1.0.358",
"v1.0.359",
"v1.0.360",
"v1.0.361",
"v1.0.362",
"v1.0.363",
"v1.0.364",
"v1.0.365",
"v1.0.366",
"v1.0.367",
"v1.0.368",
"v1.0.369",
"v1.0.370",
"v1.0.371",
"v1.0.372",
"v1.0.373",
"v1.0.374",
"v1.0.375",
"v1.0.376",
"v1.0.377",
"v1.0.378",
"v1.0.379",
"v1.0.380",
"v1.0.381",
"v1.0.382",
"v1.0.383",
"v1.0.384",
"v1.0.385",
"v1.0.386",
"v1.0.387",
"v1.0.388",
"v1.0.389",
"v1.0.390",
"v1.0.391",
"v1.0.392",
"v1.0.393",
"v1.0.394",
"v1.0.395",
"v1.0.396",
"v1.0.397",
"v1.0.398",
"v1.0.399",
"v1.0.400",
"v1.0.401",
"v1.0.402",
"v1.0.403",
"v1.0.404",
"v1.0.405",
"v1.0.406",
"v1.0.407",
"v1.0.408",
"v1.0.409",
"v1.0.410",
"v1.0.411",
"v1.0.412",
"v1.0.413",
"v1.0.414",
"v1.0.415",
"v1.0.416",
"v1.0.417",
"v1.0.418",
"v1.0.419",
"v1.0.420",
"v1.0.421",
"v1.0.422",
"v1.0.423",
"v1.0.424",
"v1.0.425",
"v1.0.426",
"v1.0.427",
"v1.0.428",
"v1.0.429",
"v1.0.430",
"v1.0.431",
"v1.0.432",
"v1.0.433",
"v1.0.434",
"v1.0.435",
"v1.0.436",
"v1.0.437",
"v1.0.438",
"v1.0.439",
"v1.0.440",
"v1.0.441",
"v1.0.442",
"v1.0.443",
"v1.0.444",
"v1.0.445",
"v1.0.446",
"v1.0.447",
"v1.0.448",
"v1.0.449",
"v1.0.450",
"v1.0.451",
"v1.0.452",
"v1.0.453",
"v1.0.454",
"v1.0.455",
"v1.0.456",
"v1.0.457",
"v1.0.458",
"v1.0.459",
"v1.0.460",
"v1.0.461",
"v1.0.462",
"v1.0.463",
"v1.0.464",
"v1.0.465",
"v1.0.466",
"v1.0.467",
"v1.0.468",
"v1.0.469",
"v1.0.470",
"v1.0.471",
"v1.0.472",
"v1.0.473",
"v1.0.474",
"v1.0.476",
"v1.1.0",
"v1.1.1",
"v1.1.10",
"v1.1.12",
"v1.1.2",
"v1.1.3",
"v1.1.4",
"v1.1.5",
"v1.1.7",
"v1.1.8",
"v1.1.9",
"v2.0.0",
"v2.0.13",
"v2.0.18",
"v2.0.20",
"v2.0.21",
"v2.0.22",
"v2.0.23",
"v2.0.25",
"v2.0.27",
"v2.0.28",
"v2.0.29",
"v2.0.3",
"v2.0.4",
"v2.0.5",
"v2.1.0",
"v2.1.1",
"v2.1.11",
"v2.1.12",
"v2.1.20",
"v2.1.21",
"v2.1.22",
"v2.1.23",
"v2.1.24",
"v2.1.25",
"v2.1.27",
"v2.1.28",
"v2.1.29",
"v2.1.3",
"v2.1.32",
"v2.1.5",
"v2.1.6",
"v2.1.7",
"v2.1.8",
"v2.2.0",
"v2.2.10",
"v2.2.11",
"v2.2.15",
"v2.2.17",
"v2.2.18",
"v2.2.19",
"v2.2.25",
"v2.2.26",
"v2.2.27",
"v2.2.28",
"v2.2.30",
"v2.2.32",
"v2.2.34",
"v2.2.4",
"v2.2.6",
"v2.2.7",
"v2.2.8",
"v2.2.9",
"v3.0.0",
"v3.0.1",
"v3.0.10",
"v3.0.12",
"v3.0.13",
"v3.0.14",
"v3.0.17",
"v3.0.2",
"v3.0.21",
"v3.0.22",
"v3.0.30",
"v3.0.36",
"v3.0.37",
"v3.0.38",
"v3.0.4",
"v3.0.41",
"v3.0.42",
"v3.0.43",
"v3.0.44",
"v3.0.5",
"v3.0.55",
"v3.0.56",
"v3.0.57",
"v3.0.58",
"v3.0.59",
"v3.0.6",
"v3.0.61",
"v3.0.64",
"v3.0.65",
"v3.0.66",
"v3.0.67",
"v3.0.7",
"v3.0.73",
"v3.0.74",
"v3.0.75",
"v3.0.9",
"v3.1.0",
"v3.1.1",
"v3.1.10",
"v3.1.12",
"v3.1.14",
"v3.1.18",
"v3.1.19",
"v3.1.20",
"v3.1.22",
"v3.1.23",
"v3.1.25",
"v3.1.26",
"v3.1.27",
"v3.1.28",
"v3.1.3",
"v3.1.4",
"v3.1.5",
"v3.1.7",
"v3.1.9",
"v3.2.0",
"v3.2.11",
"v3.2.12",
"v3.2.13",
"v3.2.14",
"v3.2.15",
"v3.2.16",
"v3.2.20",
"v3.2.22",
"v3.2.23",
"v3.2.8",
"v3.3.0",
"v3.3.10",
"v3.3.12",
"v3.3.14",
"v3.3.15",
"v3.3.18",
"v3.3.3",
"v3.3.7",
"v3.3.9",
"v3.4.0",
"v3.4.10",
"v3.4.11",
"v3.4.12",
"v3.4.14",
"v3.4.15",
"v3.4.16",
"v3.4.17",
"v3.4.18",
"v3.4.3",
"v3.4.7",
"v3.4.9",
"v3.5.0",
"v3.5.1",
"v3.5.10",
"v3.5.13",
"v3.5.2",
"v3.5.6",
"v3.5.8",
"v3.5.9",
"v3.6.0",
"v3.6.1",
"v3.6.11",
"v3.6.12",
"v3.6.14",
"v3.6.15",
"v3.6.16",
"v3.6.18",
"v3.6.19",
"v3.6.20",
"v3.6.22",
"v3.6.23",
"v3.6.25",
"v3.6.28",
"v3.6.30",
"v3.6.4",
"v3.6.7",
"v3.6.8",
"v3.6.9",
"v3.7.0",
"v3.7.11",
"v3.7.12",
"v3.7.3",
"v3.7.4",
"v3.7.5",
"v3.7.7",
"v3.7.8"
]
}