Medium severity6.2NVD Advisory· Published Oct 13, 2022· Updated Jun 17, 2026
CVE-2022-35944
CVE-2022-35944
Description
October is a self-hosted Content Management System (CMS) platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin panel and permission to open the "Editor" section, they can bypass the Safe Mode (cms.safe_mode) restriction to introduce new PHP code in a CMS template using a specially crafted request. The issue has been patched in versions 2.2.34 and 3.0.66.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
october/systemPackagist | >= 2.0.0, < 2.2.34 | 2.2.34 |
october/systemPackagist | >= 3.0.0, < 3.0.66 | 3.0.66 |
Affected products
3cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*range: <2.2.34
- (no CPE)range: >= 3.0.0, < 3.0.66
Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-x4q7-m6fp-4v9vghsaADVISORY
- github.com/octobercms/october/security/advisories/GHSA-x4q7-m6fp-4v9vnvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2022-35944ghsaADVISORY
News mentions
0No linked articles in our index yet.