CVE-2026-100909

HIGH 7.3

OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version 4.3.5 and 4.4.0 is sufficient to resolve this issue. The patch is identified as 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58. The affected component should be upgraded.

CWE	CWE-918
Vendor	n/a
Product	octobercms
Published	Sep 28, 2026

Stay Ahead of the Next One

Get instant alerts for n/a octobercms

Be the first to know when new high vulnerabilities affecting n/a octobercms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

n/a / OctoberCMS

4.1.0 4.1.1 4.1.2 4.1.3 4.1.4 4.1.5 4.1.6 4.1.7 4.1.8 4.1.9 4.1.10 4.1.11 4.1.12 4.1.13 4.1.14 4.1.15 4.1.16 4.1.17 4.1.18 4.1.19 4.2.0 4.2.1 4.2.2 4.2.3 4.2.4 4.2.5 4.2.6 4.2.7 4.2.8 4.2.9 4.2.10 4.2.11 4.2.12 4.2.13 4.2.14 4.2.15 4.2.16 4.2.17 4.2.18 4.2.19 4.2.20 4.2.21 4.2.22 4.2.23 4.2.24 4.2.25 4.3.0 4.3.1 4.3.2 4.3.3 4.3.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/410869 vuldb.com: https://vuldb.com/vuln/410869/cti vuldb.com: https://vuldb.com/cve/CVE-2026-100909 vuldb.com: https://vuldb.com/submit/919993 github.com: https://github.com/octobercms/october/security/advisories/GHSA-2xmm-m4wv-3fjh github.com: https://github.com/0xGenesi/CVE/blob/main/October_CMS_Stream_Wrapper_Injection.md github.com: https://github.com/octobercms/october/commit/0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58 github.com: https://github.com/octobercms/october/releases/tag/v4.3.5

Credits

🔍 chenhuanlin (VulDB User)