October CMS Safe Mode sandbox bypass via Session Store & Eloquent (CVE-2025-46586)

Summary of Key Vulnerability Information Vulnerability Overview Vulnerability Name: Safe Mode sandbox escape (via Session Store and forwarded Builder calls) CVE ID: CVE-2025-46586 Severity: Low (CVSS v3.1 score 3.3/10) Description: When is enabled, the Laravel session store is exposed to Twig’s unqualified method access, and methods can be forwarded via Eloquent’s to an unrestricted full builder chain. Combined, a backend user with CMS tag edit permissions can read arbitrary database values (via raw SQL expressions) and write to the backend authentication session key, thereby impersonating another database user’s backend session. Scope of Impact: The impact scope is narrow. Safe Mode is a fine-grained feature primarily used for demo installations, multi-tenant, or shared environments. Standard production sites are not affected, as ordinary October CMS administrators are considered fully trusted users, and CMS tag edit permissions are already sufficient to bypass Safe Mode. Affected Versions: <3.7.17, <=4.2.22 Fixed Versions: 3.7.17, 4.2.23 Trigger Conditions is enabled (a fine-grained option for demo/test/shared environments) The site has at least one backend user with CMS tag edit permissions (non-admin) The site has at least one existing admin account whose session can be impersonated by a lower-privileged user Impact Arbitrary reading of database tables (including admin-persisted code) via raw SQL expressions in the table Reading accessible s via classes like , , or those allowing forwarding to the query builder Impersonating an existing admin by writing values to the session key Not exploitable when Safe Mode is disabled (PHP tag edit permissions are already sufficient to bypass Safe Mode) Remediation The vulnerability is fixed in v3.7.17 and v4.2.23 The Laravel session store is wrapped in a proxy that exposes only an explicit subset of read-only session key prefixes ( , , , , and other framework-internal keys) Raw SQL and subquery methods ( , , , , ) are blocked forwarding chains from and are blocked Recommendation: Upgrade to the latest fixed versions Notes If immediate upgrade is not possible: restrict CMS tag edit permissions to fully trusted administrators (the recommended practice for standard October CMS) Disabling is not a workaround: Safe Mode is precisely the boundary affected by this vulnerability; disabling it removes the only sandbox

Goal Reached Thanks to every supporter — we hit 100%!

October CMS Safe Mode sandbox bypass via Session Store & Eloquent (CVE-2025-46586)

More from this source