rootpwn

high · CVSS v3 7.3 · CVSS v4 6.9 · EPSS 0.00298

CVE-2026-100909

OctoberCMS versions up to 4.3.4 contain a server-side request forgery vulnerability in the image resize function. An attacker can supply cra

Overview

OctoberCMS versions up to 4.3.4 contain a server-side request forgery vulnerability in the image resize function. An attacker can supply crafted paths to force the server to request arbitrary URLs, potentially leaking internal resources or executing further attacks. The flaw is publicly known and can be exploited remotely.

Description

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version 4.3.5 and 4.4.0 is sufficient to resolve this issue. The patch is identified as 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58. The affected component should be upgraded.

Impact

Confidentiality: potential exposure of internal URLs and data. Integrity: attacker may cause the server to fetch unintended resources, possibly altering application state. Availability: repeated requests could lead to DoS. Defenders: site administrators and developers using OctoberCMS must patch or mitigate.

Remediation

Upgrade to OctoberCMS 4.3.5 or 4.4.0. If upgrade is not possible, restrict the getSourcePathForResize input to allow only local file paths, e.g., validate against a whitelist or use a safe path resolver. Monitor outbound HTTP requests for suspicious patterns.

Risk context

Severity is high with CVSS 7.3; EPSS 0.00298 indicates low probability of exploitation but the vulnerability is publicly disclosed. Defenders should prioritize patching as soon as possible to mitigate potential remote exploitation.

Affected products

  • OctoberCMS 4.1
  • OctoberCMS 4.2
  • OctoberCMS 4.3

Scores

Severity
high
CVSS v2
7.5
CVSS v3
7.3
CVSS v4
6.9
EPSS
0.00298

SSRF OctoberCMS image-resize remote-exploit high-severity patch web-application

← All CVEs

Related CVEs

high

CVE-2026-97885

CloudClassroom-PHP-Project is vulnerable to a remote SQL injection via the fid parameter in updatefaculty.php. The flaw allows attackers to manipulate database queries and potentially exfiltrate or modify data. It is publicly disclosed and can be exploited without authentication.

View analysis

high

CVE-2026-101015

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the component Domain Handler. Executing a manipulation can lead to improper validation of unsafe equivalence in input. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

high

CVE-2026-86950

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

View analysis

high

CVE-2026-100888

A weakness has been identified in Trusted Domain Project OpenDKIM up to 2.11.0. This affects the function dkim_canon_selecthdrs of the file libopendkim/dkim-canon.c of the component DKIM Signature Header Selection. Executing a manipulation of the argument h can lead to out-of-bounds write. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis