7.5

CVE-2026-100909

Exploit

OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version 4.3.5 and 4.4.0 is sufficient to resolve this issue. The patch is identified as 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58. The affected component should be upgraded.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellern/a
≫
Produkt OctoberCMS
Version 4.1.0
Status affected
Version 4.1.1
Status affected
Version 4.1.2
Status affected
Version 4.1.3
Status affected
Version 4.1.4
Status affected
Version 4.1.5
Status affected
Version 4.1.6
Status affected
Version 4.1.7
Status affected
Version 4.1.8
Status affected
Version 4.1.9
Status affected
Version 4.1.10
Status affected
Version 4.1.11
Status affected
Version 4.1.12
Status affected
Version 4.1.13
Status affected
Version 4.1.14
Status affected
Version 4.1.15
Status affected
Version 4.1.16
Status affected
Version 4.1.17
Status affected
Version 4.1.18
Status affected
Version 4.1.19
Status affected
Version 4.2.0
Status affected
Version 4.2.1
Status affected
Version 4.2.2
Status affected
Version 4.2.3
Status affected
Version 4.2.4
Status affected
Version 4.2.5
Status affected
Version 4.2.6
Status affected
Version 4.2.7
Status affected
Version 4.2.8
Status affected
Version 4.2.9
Status affected
Version 4.2.10
Status affected
Version 4.2.11
Status affected
Version 4.2.12
Status affected
Version 4.2.13
Status affected
Version 4.2.14
Status affected
Version 4.2.15
Status affected
Version 4.2.16
Status affected
Version 4.2.17
Status affected
Version 4.2.18
Status affected
Version 4.2.19
Status affected
Version 4.2.20
Status affected
Version 4.2.21
Status affected
Version 4.2.22
Status affected
Version 4.2.23
Status affected
Version 4.2.24
Status affected
Version 4.2.25
Status affected
Version 4.3.0
Status affected
Version 4.3.1
Status affected
Version 4.3.2
Status affected
Version 4.3.3
Status affected
Version 4.3.4
Status affected
Version 4.3.5
Status unaffected
Version 4.4.0
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.3% 0.202
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
cna@vuldb.com 5.5 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
cna@vuldb.com 7.3 3.9 3.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
cna@vuldb.com 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

https://vuldb.com/vuln/410869
https://vuldb.com/vuln/410869/cti
https://vuldb.com/cve/CVE-2026-100909
https://vuldb.com/submit/919993
https://github.com/octobercms/october/security/advisories/GHSA-2xmm-m4wv-3fjh
https://github.com/0xGenesi/CVE/blob/main/October_CMS_Stream_Wrapper_Injection.md
https://github.com/octobercms/october/commit/0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58
https://github.com/octobercms/october/releases/tag/v4.3.5