---
title: "CVE-2023-44382: October CMS safe mode bypass using Twig sandbox escape"
url: https://erroneo.us/security/cve/CVE-2023-44382/
description: "CVE-2023-44382 (october/system (Composer (PHP))): October is a Content Management System (CMS) and web platform to assist with development workflow. An…"
type: vulnerability-record
section: "Security Digest"
date_published: 2023-12-01
date_modified: 2024-08-02
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2023-44382"
kev: false
cvss: 9.1
epss: 0.00873
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2023-44382: October CMS safe mode bypass using Twig sandbox escape

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.9% , percentile 58: FIRST’s model estimates a 0.9% chance of exploitation activity in the next 30 days, higher than 58% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Needs an account (high (admin)). Exposure depends on who can log in.
- Only applies if your dependency tree includes october/system (Composer (PHP)) >= 3.0.0, < 3.4.15, fixed in 3.4.15 . Check your lockfile, including transitive dependencies.

## What it is

October is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the editor.cmspages, editor.cmslayouts, or editor.cmspartials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to cms.safemode being enabled can write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This issue has been patched in 3.4.15.

## Affected packages

- Composer (PHP) `october/system` >= 3.0.0, < 3.4.15 → fixed: 3.4.15

## Affected products (CVE record)

- octobercms october: >= 3.0.0, < 3.4.15

## Severity

- GitHub_M CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- FIRST EPSS (model of 2026-10-21): 0.87% probability of exploitation activity in the next 30 days; percentile 58.

## Sources

- [GitHub Advisory GHSA-p8q3-h652-65vx](https://github.com/advisories/GHSA-p8q3-h652-65vx)
- [CVE.org record CVE-2023-44382](https://www.cve.org/CVERecord?id=CVE-2023-44382)
- [NVD entry CVE-2023-44382](https://nvd.nist.gov/vuln/detail/CVE-2023-44382)
- [github.com](https://github.com/octobercms/october/security/advisories/GHSA-p8q3-h652-65vx)

---
Source page: https://erroneo.us/security/cve/CVE-2023-44382/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt