PT-2026-34003 · October · October

Published 2026-04-21 · Updated 2026-04-22 · CVE-2026-26274

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions October versions prior to 3.7.14 October versions prior to 4.1.10

Description A flaw in the Twig sandbox security policy allows database write operations when cms.safe mode is enabled. Backend users with Developer permissions can use Twig template markup to perform insert, update, and delete operations on any database table via the query builder, which is included in the sandbox allow-list.

Recommendations Update to version 3.7.14 Update to version 4.1.10

Fix

Incomplete List of Disallowed Inputs

Incorrect Authorization

Weakness Enumeration

CWE-184

CWE-863

Related Identifiers

CVE-2026-26274

GHSA-H6JM-F4HH-FW27

Affected Products

October

References · 8

• https://osv.dev/vulnerability/GHSA-h6jm-f4hh-fw27 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26274 · Security Note
• https://github.com/octobercms/october/security/advisories/GHSA-h6jm-f4hh-fw27 · Note
• https://github.com/octobercms/october · Note
• https://twitter.com/infoflowcloud/status/2046637669682184697 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1ssjoms/resumen_diario_de_vulnerabilidades_22042026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1ssnpas/resumen_diario_de_vulnerabilidades_22042026 · Reddit Post
• https://twitter.com/CVEnew/status/2046636252082942263 · Twitter Post