CVE-2026-49400 – PHP Object Injection in October CMS SessionMaker (Safe Mode)

Executive summary

A PHP object injection vulnerability (CVE‑2026‑49400) exists in the October System module for October CMS. The flaw affects versions prior to 3.7.17 and 4.2.21 and is exploitable only when the optional cms.safe_mode feature is enabled.

What is affected

• Product: October System module for October CMS
• Vulnerable versions: All releases before 3.7.17 and 4.2.21
• Feature prerequisite: cms.safe_mode must be enabled (a niche opt‑in used for demo or multi‑tenant installations).

Severity and evidence

• No CVSS score was published in the source.
• The vulnerability enables PHP object injection via unsafe unserialize() when attacker‑controlled data can be written to a widget.* session key.
• Exploitation also requires a suitable PHP gadget chain in the installed dependency set.
• No public exploit or active exploitation was reported.

Business or operational impact

• Impact is limited to environments that deliberately enable Safe Mode, typically demo or shared‑editor scenarios.
• In standard production deployments Safe Mode is disabled and backend access is limited to trusted administrators, reducing real‑world risk.
• Successful exploitation could allow an attacker to instantiate arbitrary PHP classes, potentially leading to remote code execution depending on the gadget chain.

Detection considerations

• Monitor for writes to session keys matching the pattern widget.* originating from untrusted users.
• Look for usage of unserialize() without the allowed_classes option in the Backend\Traits\SessionMaker trait.
• Review logs for unexpected class instantiation errors or PHP warnings related to unserialization.

Recommended defensive actions

1. Upgrade immediately to October CMS 3.7.17 or 4.2.21 (or later) where the issue is patched.
2. If Safe Mode is not required, disable cms.safe_mode to eliminate the attack surface.
3. Verify that the patched code now stores widget session state as plain JSON and that any legacy fallback uses allowed_classes => false.
4. Conduct a code review of custom plugins or extensions that may still invoke unsafe unserialize patterns.

Workarounds or mitigations, if supported

• Restrict access to the CMS markup editor to fully trusted administrators, as recommended by October CMS for any deployment.
• Ensure that only authorized users can reach the Safe Mode sandbox.

Patch or remediation status

• The vulnerability has been patched in October CMS v3.7.17 and v4.2.21.
• The patch changes the storage format to JSON and hardens the legacy unserialize path.

References

• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-49400

Publication date and last checked date

• Publication date: 2026‑09‑16
• Last checked: 2026‑09‑17