{"id":"CVE-2022-21705","aliases":["GHSA-79jw-2f46-wv22"],"url":"https://o3.security/vulnerability/CVE-2022-21705","summary":"Authenticated remote code execution in octobercms","details":"### Impact\n\nAn authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass  `cms.safe_mode` / `cms.enableSafeMode` in order to execute arbitrary code.\n\n- This issue only affects admin panels that rely on safe mode and restricted permissions.\n- To exploit this vulnerability, an attacker must first have access to the backend area.\n\n### Patches\n\nThe issue has been patched in Build 474 (v1.0.474) and v1.1.10.\n\n### Workarounds\n\nApply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually if unable to upgrade to Build 474 or v1.1.10.\n\n### References\n\nCredits to:\n- David Miller\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n- Email us at [hello@octobercms.com](mailto:hello@octobercms.com)","published":"2022-02-23T19:00:10Z","modified":"2026-09-22T03:30:47.982891273Z","cvss":{"score":7.2,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.0865,"percentile":0.94762,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"october/system","fixedVersion":"1.0.474"},{"ecosystem":"Packagist","name":"october/system","fixedVersion":"1.1.10"},{"ecosystem":"Packagist","name":"october/system","fixedVersion":"2.1.27"}],"fix":{"url":"https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe","label":"octobercms/library@c393c5c"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21705.json"},{"type":"ADVISORY","url":"https://github.com/octobercms/october/security/advisories/GHSA-79jw-2f46-wv22"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21705"},{"type":"FIX","url":"https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe"},{"type":"WEB","url":"https://github.com/octobercms/october"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-22T03:30:47.982891273Z"}}