CVE-2020-15247— Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2020-15247
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.
Source: NVD (National Vulnerability Database)
Vulnerability Description
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, an authenticated backend user with the cms.manage_pages, cms.manage_layouts, or cms.manage_partials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to cms.enableSafeMode being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This is not a problem for anyone that trusts their users with those permissions to normally write & manage PHP within the CMS by not having cms.enableSafeMode enabled, but would be a problem for anyone relying on cms.enableSafeMode to ensure that users with those permissions in production do not have access to write & execute arbitrary PHP. Issue has been patched in Build 469 (v1.0.469) and v1.1.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制缺失
Source: NVD (National Vulnerability Database)
Vulnerability Title
October CMS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
October CMS是一套基于PHP和Laravel Web应用程序框架的开源内容管理系统（CMS）。 October 1.0.319和1.0.470之前版本存在安全漏洞，该漏洞源于启用的enableSafeMode能够编写特定的Twig代码来逃避Twig沙箱并执行任意的PHP。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| octobercms | october | >= 1.0.319, < 1.0.469 | - |
II. Public POCs for CVE-2020-15247
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-15247
请登录查看更多情报信息。
Same Patch Batch · octobercms · 2020-11-23 · 5 CVEs total
| CVE-2020-15246 | 7.5 HIGH | Local File Inclusion by unauthenticated users |
| CVE-2020-26231 | 5.2 MEDIUM | Bypass of fix for CVE-2020-15247, Twig sandbox escape |
| CVE-2020-15248 | 4.0 MEDIUM | Privilege escalation by backend users assigned to the default "Publisher" system role |
| CVE-2020-15249 | 2.8 LOW | Stored XSS by authenticated backend user with access to upload files |
IV. Related Vulnerabilities
Same product: october
- CVE-2026-29179
October: Editor Sub-Permission Bypass for Asset and Blueprin - CVE-2026-27937
October: Reflected XSS via DataTable Form Widget - CVE-2026-26274
October: Safe Mode Bypass via Twig Database Write Operations - CVE-2026-26067
October: Safe Mode Bypass via CSS Preprocessor Compilers - CVE-2026-25133
October CMS has Stored XSS via SVG Filter Bypass
Same vendor: octobercms
- CVE-2026-29179
October: Editor Sub-Permission Bypass for Asset and Blueprin - CVE-2026-27937
October: Reflected XSS via DataTable Form Widget - CVE-2026-26274
October: Safe Mode Bypass via Twig Database Write Operations - CVE-2026-26067
October: Safe Mode Bypass via CSS Preprocessor Compilers - CVE-2026-25133
October CMS has Stored XSS via SVG Filter Bypass
Same weakness: CWE-862
- CVE-2021-47932
WordPress TheCartPress 1.5.3.6 Privilege Escalation Unauthen - CVE-2025-15634
HCL BigFix WebUI is affected by a missing authorization vuln - CVE-2026-42297
Argo Workflows Is Missing Authorization in Sync ConfigMap Pr - CVE-2026-42174
Kirby: User avatar creation, replacement and deletion are no - CVE-2026-42137
Kirby: `pages.access/list` and `files.access/list` permissio
V. Comments for CVE-2020-15247
No comments yet