October CMS allows backend users with Developer permission to write to any database table through Twig template markup when safe mode is enabled. The vulnerability stems from an overly permissive sandbox allow‑list that includes the query builder, permitting insert, update, and delete operations. An attacker who can exploit this can alter, delete, or corrupt website data, compromising data integrity and potentially enabling further malicious actions.

October CMS versions older than 3.7.14 or 4.1.10 are affected. The issue exists in the core October product when the cms.safe_mode configuration is enabled.

The CVSS score of 6.6 indicates moderate severity. EPSS data is unavailable, so the likelihood of exploitation is uncertain. The vulnerability is not listed in CISA’s KEV catalog. Likely attack vectors involve a legitimate developer with backend access who can inject Twig code; no additional network-level access is required.