CVE-2026-100909OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery
Updated under an hour ago ()
Does this affect you?
It affects n/a OctoberCMS. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.30%, higher than 21% of scored CVEs.
Do this next
Free account, 1 product
A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version 4.3.5 and 4.4.0 is sufficient to resolve this issue. The patch is identified as 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58. The affected component should be upgraded.
- CVSS
- 7.3 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
- Weakness (CWE)
- CWE-918
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.30% (percentile 21)
- Assigned by
- VulDB
- NVD analysis
- Deferred
- Record last updated
- Sep 28, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
n/a OctoberCMS octobercms:octobercms | 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.4; 4.1.5; 4.1.6; 4.1.7; and 45 more ranges | CNA record |
References
- https://vuldb.com/vuln/410869vdb-entry, technical-description
- https://vuldb.com/vuln/410869/ctisignature, permissions-required
- https://vuldb.com/cve/CVE-2026-100909third-party-advisory
- https://vuldb.com/submit/919993third-party-advisory
- https://github.com/octobercms/october/security/advisories/GHSA-2xmm-m4wv-3fjhrelated
- https://github.com/0xGenesi/CVE/blob/main/October_CMS_Stream_Wrapper_Injection.mdexploit
- https://github.com/octobercms/october/commit/0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58patch
- https://github.com/octobercms/october/releases/tag/v4.3.5patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.