lukasz-rybak/CVE-2026-22692

PoC

CVE-2026-22692 - Critical Twig Sandbox Bypass via collect()->mapInto() allowing RCE/LFI/XXE in October CMS

view exploit source poc_in_githubauthor lukasz-rybakpublished 2026-04-14catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2026-22692US	medium6.8	0.40% (34th)	Exploit	2026-04-14
October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the optional Twig…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.