The vulnerability arises from the optional Twig safe mode (CMS_SAFE_MODE) in October CMS. Certain methods on the collect() helper were not properly restricted, enabling authenticated users with template editing permissions to bypass sandbox protections. This bypass permits the execution of arbitrary code within Twig templates. The weakness is a failure to enforce proper access control (CWE‑284) and a protection failure (CWE‑693).

October CMS versions prior to 3.7.13 and 4.0.0 through 4.1.4. The issue only impacts installations where the CMS_SAFE_MODE feature is enabled, which is disabled by default.

The CVSS score of 4.9 indicates moderate severity. Exploitation requires authenticated backend access with template editing permissions and the CMS_SAFE_MODE setting enabled. EPSS data is not available, and the vulnerability is not in the CISA KEV catalog. Attackers must first gain legitimate user credentials; there is no known unauthenticated vector, so the risk is moderate to high for organizations with admins who have template editing rights.