Listen to this Post
The backend `SessionMaker` trait stored widget session state as `base64(serialize(…))` and consumed it with `unserialize()` without an `allowed_classes` restriction. Any code path that could write to a `widget.` session key with attacker-controlled bytes could trigger PHP object injection the next time the widget read its session state, allowing instantiation of arbitrary classes and reachable PHP gadget chains. This issue only affects installations running with `cms.safe_mode` enabled. Safe Mode is a niche opt-in feature, primarily used for demo installations and multi-tenant or shared-editor scenarios where untrusted users are deliberately granted access to the CMS markup editor. In standard production deployments Safe Mode is off, backend access is restricted to trusted administrators, and a markup editor can already execute arbitrary PHP directly. The session-write path that reaches this sink is gated by the Safe Mode sandbox, so installations without Safe Mode enabled are not exposed. Scope of impact is narrow even with Safe Mode enabled. The standard backend code paths that populate widget session state (search terms, sort options, selected IDs, filter values) wrap the input inside a known array shape before serializing, so user-supplied values never reach `unserialize()` as a controllable serialized payload. Exploitation requires the Safe Mode session-write path together with a suitable PHP gadget chain reachable from the installed dependency set. The hardening removes the underlying object-injection sink so the class of issue is closed off regardless.
DailyCVE Form:
Platform: October CMS
Version: Prior 3.7.17 4.2.21
Vulnerability : PHP Object Injection
Severity: Low
date: 2026-09-14
Prediction: Patched 3.7.17 4.2.21
What Undercode Say:
Analytics:
Check if safe_mode is enabled
php artisan tinker --execute="echo config('cms.safe_mode');"
List widget session keys
php artisan tinker --execute="print_r(array_keys(session()->all()));"
Generate a PHP gadget chain payload
phpggc -o payload.bin Monolog/RCE1 system id
Base64 encode the serialized payload
base64 payload.bin
Inject into session via a write path (e.g., a custom widget that reads user input)
// Vulnerable code in Backend\Traits\SessionMaker
public function getSessionState($widget)
{
$sessionKey = $this->getSessionKey($widget);
$data = Session::get($sessionKey);
if ($data) {
return unserialize(base64_decode($data));
}
return [];
}
Exploit: (Educational Purposes!)
1. Ensure `cms.safe_mode` is enabled.
- Authenticate as a backend user with CMS markup editing access.
- Identify a write path that allows controlling a `widget.` session key with arbitrary bytes.
- Generate a PHP gadget chain payload using a library like `phpggc` that is reachable from the installed dependencies.
- Base64-encode the serialized payload and write it to the target `widget.` session key.
- Trigger the widget to render, causing the `unserialize()` call to instantiate the gadget chain and execute arbitrary PHP code as the web server user.
Protection: from this CVE
- Upgrade to October CMS v3.7.17 or v4.2.21 immediately.
- If upgrading is not possible, restrict CMS markup editing access to fully trusted administrators only.
- Disable `cms.safe_mode` unless it is explicitly required for multi-tenant or demo scenarios.
- Audit session write paths to ensure no user-controlled data reaches `unserialize()` without
allowed_classes => false.
Impact:
- Arbitrary PHP code execution as the web server user, via a gadget chain deserialized from a widget session key, triggered the next time the affected widget is rendered.
- Requires `cms.safe_mode` to be enabled, and a backend user with CMS markup editing access who is not intended to be trusted as a full administrator.
- A suitable PHP gadget chain must be reachable from the installed dependency set.
- Not exploitable when Safe Mode is disabled.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
