CVE-2026-49400: October CMS SessionMaker RCE Vulnerability

CVE-2026-49400 Overview

CVE-2026-49400 is a PHP object injection vulnerability in the October Content Management System (CMS) system module. The flaw resides in the Backend\Traits\SessionMaker trait, which stored widget session state as base64(serialize(...)) and consumed it with unserialize() without an allowed_classes restriction [CWE-502]. An attacker able to write attacker-controlled bytes to a widget.* session key can trigger deserialization of arbitrary classes and reachable PHP gadget chains. The issue only affects installations running with cms.safe_mode enabled, a niche opt-in feature intended for demos and multi-tenant scenarios. Versions prior to 3.7.17 and 4.2.21 are affected.

Critical Impact

Exploitation requires Safe Mode enabled, a high-privilege account with session-write access, and a suitable PHP gadget chain in the installed dependency set.

Affected Products

• October CMS System module versions prior to 3.7.17 (3.x branch)
• October CMS System module versions prior to 4.2.21 (4.x branch)
• Only installations with cms.safe_mode enabled

Discovery Timeline

• 2026-09-14 - CVE-2026-49400 published to the National Vulnerability Database (NVD)
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-49400

Vulnerability Analysis

The vulnerability is an insecure deserialization flaw in the October CMS backend. The SessionMaker trait persists widget state by wrapping serialized PHP data in Base64. When the widget rehydrates, it calls unserialize() on the decoded payload without setting allowed_classes => false. PHP therefore instantiates any class named in the payload and invokes magic methods such as __wakeup or __destruct during construction and teardown. If the installed dependency set contains a reachable gadget chain, the attacker chains these magic method calls into arbitrary side effects, potentially including code execution or file writes.

Standard backend flows that write widget session state (search terms, sort options, filters, selected IDs) wrap user input inside a known array shape before serialization. This structural wrapping prevents user-supplied bytes from reaching unserialize() as a controllable payload. Exploitation therefore requires an alternate write path that bypasses this wrapping.

Root Cause

The underlying defect is the use of unserialize() on stored data without restricting the classes PHP is allowed to instantiate. PHP object injection through unserialize() has been a well-known sink class for over a decade. The SessionMaker trait treated session storage as trusted, but Safe Mode explicitly grants untrusted editors write access to session-adjacent surfaces.

Attack Vector

An authenticated backend user operating under the Safe Mode sandbox must reach a code path that writes attacker-controlled bytes to a widget.* session key. On the next read of that widget session state, the SessionMaker trait Base64-decodes and unserializes the payload, instantiating arbitrary classes. The attacker then relies on a gadget chain reachable from installed Composer dependencies to convert object instantiation into a concrete impact.

No verified exploit code is public. The vulnerability is described in prose in the GitHub Security Advisory.

Detection Methods for CVE-2026-49400

Indicators of Compromise

• Unexpected widget.* entries in the backend session store containing Base64-encoded PHP serialized data with class markers such as O: or C:
• PHP error or warning log entries referencing unserialize(), __wakeup, or __destruct originating from Backend\Traits\SessionMaker
• Backend user accounts with markup editor access exhibiting session writes outside normal widget interaction patterns

Detection Strategies

• Inventory October CMS installations and identify any instance where cms.safe_mode is set to true in the configuration
• Compare deployed system module versions against 3.7.17 and 4.2.21 to enumerate exposed installations
• Review web server logs for anomalous POST requests to backend widget endpoints from Safe Mode editor accounts

Monitoring Recommendations

• Monitor PHP process telemetry for child process spawns originating from the web server user immediately following backend session activity
• Alert on file writes to CMS theme directories, cache paths, or Composer autoload files that do not correlate with legitimate deployments
• Track backend authentication events for accounts with markup editing privileges and correlate with subsequent session-write bursts

How to Mitigate CVE-2026-49400

Immediate Actions Required

• Upgrade the October CMS system module to version 3.7.17 or 4.2.21 as appropriate for the deployed branch
• Audit config/cms.php and confirm whether safe_mode is enabled; disable it unless the deployment genuinely requires the sandbox
• Review backend user accounts and revoke markup editor permissions from any account that is not a fully trusted administrator

Patch Information

The maintainers released fixes in v3.7.17 and v4.2.21. Two changes were applied. First, Backend\Traits\SessionMaker now stores widget session state as plain JSON, eliminating the object-injection sink for new writes. Second, the legacy read path retains a one-cycle fallback for existing sessions but now passes allowed_classes => false to unserialize(), preventing object instantiation even for pre-upgrade payloads. Refer to the GitHub Security Advisory GHSA-2ff2-mx52-q8wp for full patch details.

Workarounds

• Disable cms.safe_mode in the CMS configuration if the multi-tenant sandbox use case is not required
• Restrict CMS markup editing access to fully trusted administrators only, which is the standard October CMS recommendation
• Clear existing backend session storage after upgrading to purge any legacy Base64-serialized widget state

# Disable Safe Mode in config/cms.php
'safe_mode' => false,

# Update the system module via Composer
composer require october/system:^4.2.21
php artisan october:migrate
php artisan cache:clear