Skip to content
Heist/ feed
High

OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery

Type: advisorySource: Official CVE List1 source record

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version 4.3.5 and 4.4.0 is sufficient to resolve this issue. The patch is identified as 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58. The affected component should be upgraded.

Announced Source revision 1
Original source ↗

CVE-2026-100909

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-100909

OctoberCMS

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "cpes": [
      "cpe:2.3:a:octobercms:octobercms:*:*:*:*:*:*:*:*"
    ],
    "vendor": "n/a",
    "product": "OctoberCMS",
    "versions": [
      {
        "status": "affected",
        "version": "4.1.0"
      },
      {
        "status": "affected",
        "version": "4.1.1"
      },
      {
        "status": "affected",
        "version": "4.1.2"
      },
      {
        "status": "affected",
        "version": "4.1.3"
      },
      {
        "status": "affected",
        "version": "4.1.4"
      },
      {
        "status": "affected",
        "version": "4.1.5"
      },
      {
        "status": "affected",
        "version": "4.1.6"
      },
      {
        "status": "affected",
        "version": "4.1.7"
      },
      {
        "status": "affected",
        "version": "4.1.8"
      },
      {
        "status": "affected",
        "version": "4.1.9"
      },
      {
        "status": "affected",
        "version": "4.1.10"
      },
      {
        "status": "affected",
        "version": "4.1.11"
      },
      {
        "status": "affected",
        "version": "4.1.12"
      },
      {
        "status": "affected",
        "version": "4.1.13"
      },
      {
        "status": "affected",
        "version": "4.1.14"
      },
      {
        "status": "affected",
        "version": "4.1.15"
      },
      {
        "status": "affected",
        "version": "4.1.16"
      },
      {
        "status": "affected",
        "version": "4.1.17"
      },
      {
        "status": "affected",
        "version": "4.1.18"
      },
      {
        "status": "affected",
        "version": "4.1.19"
      },
      {
        "status": "affected",
        "version": "4.2.0"
      },
      {
        "status": "affected",
        "version": "4.2.1"
      },
      {
        "status": "affected",
        "version": "4.2.2"
      },
      {
        "status": "affected",
        "version": "4.2.3"
      },
      {
        "status": "affected",
        "version": "4.2.4"
      },
      {
        "status": "affected",
        "version": "4.2.5"
      },
      {
        "status": "affected",
        "version": "4.2.6"
      },
      {
        "status": "affected",
        "version": "4.2.7"
      },
      {
        "status": "affected",
        "version": "4.2.8"
      },
      {
        "status": "affected",
        "version": "4.2.9"
      },
      {
        "status": "affected",
        "version": "4.2.10"
      },
      {
        "status": "affected",
        "version": "4.2.11"
      },
      {
        "status": "affected",
        "version": "4.2.12"
      },
      {
        "status": "affected",
        "version": "4.2.13"
      },
      {
        "status": "affected",
        "version": "4.2.14"
      },
      {
        "status": "affected",
        "version": "4.2.15"
      },
      {
        "status": "affected",
        "version": "4.2.16"
      },
      {
        "status": "affected",
        "version": "4.2.17"
      },
      {
        "status": "affected",
        "version": "4.2.18"
      },
      {
        "status": "affected",
        "version": "4.2.19"
      },
      {
        "status": "affected",
        "version": "4.2.20"
      },
      {
        "status": "affected",
        "version": "4.2.21"
      },
      {
        "status": "affected",
        "version": "4.2.22"
      },
      {
        "status": "affected",
        "version": "4.2.23"
      },
      {
        "status": "affected",
        "version": "4.2.24"
      },
      {
        "status": "affected",
        "version": "4.2.25"
      },
      {
        "status": "affected",
        "version": "4.3.0"
      },
      {
        "status": "affected",
        "version": "4.3.1"
      },
      {
        "status": "affected",
        "version": "4.3.2"
      },
      {
        "status": "affected",
        "version": "4.3.3"
      },
      {
        "status": "affected",
        "version": "4.3.4"
      },
      {
        "status": "unaffected",
        "version": "4.3.5"
      },
      {
        "status": "unaffected",
        "version": "4.4.0"
      }
    ]
  }
]
Related CVEs
CVE-2026-100909

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-100909 · Low

october/october

Event
#3025 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement