CVE-2026-49400

Name of the Vulnerable Software and Affected Versions October CMS versions prior to 3.7.17 October CMS versions prior to 4.2.21

Description The backend SessionMaker trait stores widget session state using base64(serialize(...)) and processes it with the unserialize() function without an allowed classes restriction. This can lead to PHP object injection, allowing the instantiation of arbitrary classes and the execution of PHP gadget chains, potentially resulting in arbitrary code execution as the web server user. This issue specifically affects installations where cms.safe mode is enabled, a feature used for demo installations or multi-tenant scenarios where untrusted users have access to the CMS markup editor. Exploitation requires a path to write attacker-controlled bytes to a widget.* session key and the presence of a suitable PHP gadget chain within the installed dependencies.

Recommendations Update to version 3.7.17 or later. Update to version 4.2.21 or later. Restrict CMS markup editing access to fully trusted administrators only.