CVE-2026-100909 OctoberCMS CVE debrief

Who should care

Defenders responsible for OctoberCMS installations should assess exposure and prioritize patching to prevent potential server-side request forgery attacks. This includes reviewing system configurations, verifying patch application, and ensuring system integrity. Additionally, defenders should monitor for potential attacks and review compensating controls for exposed systems.

Why it matters

Defenders should prioritize patching vulnerable OctoberCMS installations to prevent potential server-side request forgery attacks, which could lead to unauthorized requests, data breaches, or system compromise.

• Potential unauthorized requests to internal or external resources
• Possible data breaches or system compromise
• Required verification of patch application and system integrity
• Potential impact on system availability or performance

Technical summary

The `getSourcePathForResize` function in the `ResizeImages.php` file of OctoberCMS is vulnerable to server-side request forgery. The vulnerability allows remote attackers to manipulate the `realSourcePath` argument to perform unauthorized requests. This could lead to unauthorized requests to internal or external resources, possible data breaches or system compromise, and required verification of patch application and system integrity. The patch is identified as 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58 and upgrading to version 4.3.5 or 4.4.0 is sufficient to resolve this issue.

Defensive priority

Defenders should prioritize patching vulnerable OctoberCMS installations to prevent potential server-side request forgery attacks.

Recommended defensive actions

• Patch vulnerable OctoberCMS installations to version 4.3.5 or 4.4.0
• Verify that the patch 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58 is applied
• Monitor for potential server-side request forgery attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was found in OctoberCMS up to versions 4.1.19, 4.2.25, and 4.3.4. The affected component is the `ResizeImages.php` file, specifically the `getSourcePathForResize` function. The patch is identified as 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.