[LOW] October CMS: PHP Object Injection via Backend Widget Session Storage

PKSA-syjw-hb9p-2d5m CVE-2026-49400 GHSA-2ff2-mx52-q8wp

Affected package: october/system

Affected version: >=4.0.0,<4.2.23|<3.7.17

Reported by:
GitHub