CVE-2026-101005
October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery
CVSS Score
7.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 4.3.5 is able to mitigate this issue. You should upgrade the affected component.
| CWE | CWE-918 |
| Vendor | n/a |
| Product | october cms |
| Published | Sep 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for n/a october cms
Be the first to know when new high vulnerabilities affecting n/a october cms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
n/a / October CMS
4.3.0 4.3.1 4.3.2 4.3.3 4.3.4
References
vuldb.com: https://vuldb.com/vuln/410875 vuldb.com: https://vuldb.com/vuln/410875/cti vuldb.com: https://vuldb.com/cve/CVE-2026-101005 vuldb.com: https://vuldb.com/submit/922294 github.com: https://github.com/octobercms/october/security/advisories/GHSA-j2j7-7m99-6226 github.com: https://github.com/0xGenesi/CVE/blob/main/October_CMS_SSRF_IPv6_Mapped_IPv4_Bypass.md github.com: https://github.com/octobercms/october/releases/tag/v4.3.5 cybersecurity-help.cz: https://www.cybersecurity-help.cz/vdb/vulns/149488/
Credits
🔍 chenhuanlin (VulDB User)