PHP Object Injection Vulnerability in October Content Management System
CVE-2026-49400

3.3LOW

Key Information:

Vendor

Octobercms

Status
October
Vendor
CVE Published:
14 September 2026

What is CVE-2026-49400?

The October Content Management System prior to versions 3.7.17 and 4.2.21 is vulnerable to a PHP object injection issue due to the SessionMaker trait's handling of widget session states. It serializes these states without necessary restrictions, allowing for potential arbitrary code execution when an attacker controls session write operations. This vulnerability primarily affects installations with 'cms.safe_mode' enabled, which should only be done in tightly controlled environments. The issue could lead to unauthorized instantiation of PHP classes via crafted session data. In response to this vulnerability, the October CMS team has implemented a fix that changes the storage method for widget session states to plain JSON and restricts the use of unserialize to prevent object injection. Users are advised to upgrade to the latest versions and limit backend access to trusted administrators.

Affected Version(s)

october < 3.7.17 < 3.7.17

october >= 4.0.0, < 4.2.23 < 4.0.0, 4.2.23

References

https://github.com/octobercms/october/security/advisories...
x_refsource_CONFIRM

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.