漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
October CMS safe mode bypass using Twig sandbox escape
Vulnerability Description
October is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `editor.cms_pages`, `editor.cms_layouts`, or `editor.cms_partials` permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to `cms.safe_mode` being enabled can write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This issue has been patched in 3.4.15.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Vulnerability Title
October 代码注入漏洞
Vulnerability Description
October是October开源的一个内容管理系统 (CMS) 和网络平台。 October 存在代码注入漏洞，该漏洞源于在启用了“cms.safe_mode”的情况下，具有“editor.cms_pages”、“editor.cms_layouts”或“editor.cms_partials”权限的人可以编写特定的 Twig 代码来逃避 Twig 沙箱并执行任意 PHP 代码。
CVSS Information
N/A
Vulnerability Type
N/A