p PatchFirst

CVE-2026-100909

CVE-2026-100909 · OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version 4.3.5 and 4.4.0 is sufficient to resolve this issue. The patch is identified as 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58. The affected component should be upgraded.

CVSS 6.9 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • octobercms

    Versions
    • 4.1.0: Affected
    • 4.1.1: Affected
    • 4.1.2: Affected
    • 4.1.3: Affected
    • 4.1.4: Affected
    • 4.1.5: Affected
    • 4.1.6: Affected
    • 4.1.7: Affected
    • 4.1.8: Affected
    • 4.1.9: Affected
    • 4.1.10: Affected
    • 4.1.11: Affected
    • 4.1.12: Affected
    • 4.1.13: Affected
    • 4.1.14: Affected
    • 4.1.15: Affected
    • 4.1.16: Affected
    • 4.1.17: Affected
    • 4.1.18: Affected
    • 4.1.19: Affected
    • 4.2.0: Affected
    • 4.2.1: Affected
    • 4.2.2: Affected
    • 4.2.3: Affected
    • 4.2.4: Affected
    • 4.2.5: Affected
    • 4.2.6: Affected
    • 4.2.7: Affected
    • 4.2.8: Affected
    • 4.2.9: Affected
    • 4.2.10: Affected
    • 4.2.11: Affected
    • 4.2.12: Affected
    • 4.2.13: Affected
    • 4.2.14: Affected
    • 4.2.15: Affected
    • 4.2.16: Affected
    • 4.2.17: Affected
    • 4.2.18: Affected
    • 4.2.19: Affected
    • 4.2.20: Affected
    • 4.2.21: Affected
    • 4.2.22: Affected
    • 4.2.23: Affected
    • 4.2.24: Affected
    • 4.2.25: Affected
    • 4.3.0: Affected
    • 4.3.1: Affected
    • 4.3.2: Affected
    • 4.3.3: Affected
    • 4.3.4: Affected
    • 4.3.5: Not affected
    • 4.4.0: Not affected

    Update to 4.3.5

  • october/october Packagist

    Versions
    • v4.3.0
    • v4.3.1
    • v4.3.2
    • v4.3.4
    Affected ranges
    • ECOSYSTEM: ≥ 4.3.0, < 4.3.5

    Update to 4.3.5

Original sources

Check your server →