CVE-2026-100909 in OctoberCMS
Summary
by MITRE • 09/28/2026
A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version 4.3.5 and 4.4.0 is sufficient to resolve this issue. The patch is identified as 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58. The affected component should be upgraded.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/28/2026
The vulnerability in question resides within the OctoberCMS content management system, specifically affecting versions up to 4.1.19, 4.2.25, and 4.3.4. This security flaw is located in the getSourcePathForResize function found in the modules/system/classes/ResizeImages.php file. The core issue stems from improper validation of user-supplied input passed as the realSourcePath argument. When this parameter is manipulated by an attacker, it allows for server-side request forgery attacks to be executed remotely. This type of vulnerability enables attackers to trick the vulnerable application into making requests to unintended destinations, potentially accessing internal resources that are not otherwise accessible or performing actions on behalf of the authenticated user without their knowledge.
Server-side request forgery represents a significant risk as it can lead to unauthorized access to sensitive data stored within the organization's network infrastructure. Attackers may exploit this weakness to probe internal networks, bypass firewalls, and interact with backend services that are typically shielded from external exposure. The fact that an exploit has been made public increases the likelihood of automated attacks targeting unpatched systems. This vulnerability is categorized under CWE-918, which addresses Server-Side Request Forgery (SSRF), highlighting the failure to validate or sanitize user input before processing it in server-side operations. From a tactical perspective, this aligns with ATT&CK technique T1571, where adversaries establish communications through internal services to evade detection and expand their foothold within compromised environments.
The operational impact of this vulnerability extends beyond mere data exfiltration. Successful exploitation could allow attackers to perform denial-of-service attacks against internal systems by flooding them with requests or manipulate backend APIs that rely on the CMS for authentication tokens. Given that OctoberCMS is often used in web applications where image processing is a common feature, any endpoint utilizing image resizing functionality becomes a potential entry point. The public availability of exploits means that even organizations without specific targeting may fall victim to opportunistic attacks scanning for known vulnerabilities in widely deployed software components.
To mitigate this risk, it is imperative to upgrade OctoberCMS to version 4.3.5 or later, including version 4.4.0 and beyond. These versions contain the necessary patches identified by commit hash 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58, which properly validates input parameters to prevent SSRF attacks. Organizations should prioritize applying these updates across all affected instances immediately. Additionally, implementing network-level controls such as web application firewalls can provide an additional layer of defense by detecting and blocking suspicious outbound requests originating from the CMS server. Regular security audits and monitoring for anomalous traffic patterns will further enhance resilience against exploitation attempts while patching procedures are being executed.