What is CVE-2026-49400?

CVE-2026-49400 is a low-severity insecure deserialization vulnerability in october/system (composer), affecting versions < 3.7.17. It is fixed in 3.7.17, 4.2.23. Untrusted serialized data is processed by a deserializer that can instantiate arbitrary objects or execute code as a side effect.

How severe is CVE-2026-49400?

CVE-2026-49400 has a CVSS score of 3.3 (Low). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Which versions of october/system are affected by CVE-2026-49400?

october/system (composer) versions < 3.7.17 is affected.

Is there a fix for CVE-2026-49400?

Yes. CVE-2026-49400 is fixed in 3.7.17, 4.2.23. Upgrade to this version or later.

Is CVE-2026-49400 exploitable, and should I be worried?

Whether CVE-2026-49400 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2026-49400 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix CVE-2026-49400?

Upgrade: october/system to 3.7.17 or later, october/system to 4.2.23 or later.

CVE-2026-49400 in october/system

Q: How severe is CVE-2026-49400?

CVE-2026-49400 has a CVSS score of 3.3 (Low). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Q: Which versions of october/system are affected by CVE-2026-49400?

october/system (composer) versions < 3.7.17 is affected.

Q: Is there a fix for CVE-2026-49400?

Yes. CVE-2026-49400 is fixed in 3.7.17, 4.2.23. Upgrade to this version or later.

Q: Is CVE-2026-49400 exploitable, and should I be worried?

Whether CVE-2026-49400 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2026-49400 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2026-49400?

Upgrade: october/system to 3.7.17 or later, october/system to 4.2.23 or later.

Summary

October CMS: PHP Object Injection via Backend Widget Session Storage

The backend SessionMaker trait stored widget session state as base64(serialize(...)) and consumed it with unserialize() without an allowed_classes restriction. Any code path that could write to a widget.* session key with attacker-controlled bytes could trigger PHP object injection the next time the widget read its session state, allowing instantiation of arbitrary classes and reachable PHP gadget chains.

This issue only affects installations running with cms.safe_mode enabled. Safe Mode is a niche opt-in feature, primarily used for demo installations and multi-tenant or shared-editor scenarios where untrusted users are deliberately granted access to the CMS markup editor. In standard production deployments Safe Mode is off, backend access is restricted to trusted administrators, and a markup editor can already execute arbitrary PHP directly. The session-write path that reaches this sink is gated by the Safe Mode sandbox, so installations without Safe Mode enabled are not exposed.

Scope of impact is narrow even with Safe Mode enabled. The standard backend code paths that populate widget session state (search terms, sort options, selected IDs, filter values) wrap the input inside a known array shape before serializing, so user-supplied values never reach unserialize() as a controllable serialized payload. Exploitation requires the Safe Mode session-write path together with a suitable PHP gadget chain reachable from the installed dependency set. The hardening below removes the underlying object-injection sink so the class of issue is closed off regardless.

Workarounds

If upgrading immediately is not possible, restrict CMS markup editing access to fully trusted administrators only, the standard October CMS recommendation for any deployment.

References

Reported by EndlssNightmare

Impact

Arbitrary PHP code execution as the web server user, via a gadget chain deserialized from a widget session key, triggered the next time the affected widget is rendered
Requires cms.safe_mode to be enabled, and a backend user with CMS markup editing access who is not intended to be trusted as a full administrator
A suitable PHP gadget chain must be reachable from the installed dependency set
Not exploitable when Safe Mode is disabled

Untrusted serialized data is processed by a deserializer that can instantiate arbitrary objects or execute code as a side effect. Typical impact: arbitrary code execution or logic abuse.

CVE-2026-49400 has a CVSS score of 3.3 (Low). The vector is network-reachable, high privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (3.7.17, 4.2.23); upgrading removes the vulnerable code path.

Affected versions

october/system (< 3.7.17) october/system (>= 4.0.0, < 4.2.23)

Security releases

october/system → 3.7.17 (composer) october/system → 4.2.23 (composer)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

The vulnerability has been patched in v3.7.17 and v4.2.21. Two changes were applied:

Backend\Traits\SessionMaker now stores widget session state as plain JSON instead of base64(serialize(...)), eliminating the object-injection sink entirely for new writes. Reads transparently fall back to the legacy format for one upgrade cycle so existing sessions retain their saved widget state.
The legacy unserialize() fallback path now sets allowed_classes => false, so even values written before the upgrade cannot instantiate objects.

Frequently Asked Questions

What is CVE-2026-49400? CVE-2026-49400 is a low-severity insecure deserialization vulnerability in october/system (composer), affecting versions < 3.7.17. It is fixed in 3.7.17, 4.2.23. Untrusted serialized data is processed by a deserializer that can instantiate arbitrary objects or execute code as a side effect.
How severe is CVE-2026-49400? CVE-2026-49400 has a CVSS score of 3.3 (Low). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
Which versions of october/system are affected by CVE-2026-49400? october/system (composer) versions < 3.7.17 is affected.
Is there a fix for CVE-2026-49400? Yes. CVE-2026-49400 is fixed in 3.7.17, 4.2.23. Upgrade to this version or later.
Is CVE-2026-49400 exploitable, and should I be worried? Whether CVE-2026-49400 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2026-49400 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2026-49400?
- Upgrade october/system to 3.7.17 or later
- Upgrade october/system to 4.2.23 or later