Log in Start free

Vulnerability · Published Sep 28, 2026 · Assigned by VulDB

CVE-2026-100909OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery

High 7.3

In plain English

A high-severity server-side request forgery in OctoberCMS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.3%top 77.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version 4.3.5 and 4.4.0 is sufficient to resolve this issue. The patch is identified as 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58. The affected component should be upgraded.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistoctober/october4.3.5GHSA-2xmm-m4wv-3fjh

Affected products (as reported)

VendorProductVersions
n/a OctoberCMS 4.1.04.1.14.1.24.1.34.1.44.1.54.1.64.1.7

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References