漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
October CMS: Twig Sandbox Bypass via Collection Methods
Vulnerability Description
October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections. Exploitation requires authenticated backend access with CMS template editing permissions and only affects installations with CMS_SAFE_MODE enabled (disabled by default). This issue has been fixed in versions 3.7.13 and 4.1.5. To workaround this issue, users can disable CMS_SAFE_MODE if untrusted template editing is not required, and restrict CMS template editing permissions to fully trusted administrators only.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Vulnerability Type
保护机制失效
Vulnerability Title
October 安全漏洞
Vulnerability Description
October是October开源的一个内容管理系统 (CMS) 和网络平台。 October 3.7.13之前版本和4.1.4及之前版本存在安全漏洞，该漏洞源于Twig安全模式功能存在沙箱绕过，可能导致经过身份验证的用户绕过沙箱保护。
CVSS Information
N/A
Vulnerability Type
N/A