{"action":"Upgrade october/cms to 1.0.472 or later.","affected":[{"fixed":"1.0.472","introduced":"1.0.471"},{"fixed":"1.1.2","introduced":"1.1.1"}],"component":"october/cms","cve_ids":["CVE-2021-21264"],"ecosystem":"Packagist","epss":0.00265,"exploited":false,"fixed_versions":["1.0.472","1.1.2"],"ghsa_id":"GHSA-fcr8-6q7r-m4wg","id":"tcs_01M5KF1Q44ETWE55W9NK5S9Y1W","modified_at":"2026-07-08T06:30:01.387714458Z","published_at":"2021-05-04T17:42:33Z","references":["https://osv.dev/vulnerability/GHSA-fcr8-6q7r-m4wg","https://github.com/octobercms/october/security/advisories/GHSA-fcr8-6q7r-m4wg","https://nvd.nist.gov/vuln/detail/CVE-2021-21264","https://github.com/octobercms/october"],"severity":{"label":"medium","score":5.2},"sources":[{"source":"osv","source_id":"GHSA-fcr8-6q7r-m4wg","url":"https://osv.dev/vulnerability/GHSA-fcr8-6q7r-m4wg"}],"summary":"Bypass of fix for CVE-2020-26231, Twig sandbox escape"}