{"id":"CVE-2026-100909","summary":"OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery","details":"A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version 4.3.5 and 4.4.0 is sufficient to resolve this issue. The patch is identified as 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58. The affected component should be upgraded.","aliases":["GHSA-2xmm-m4wv-3fjh"],"modified":"2026-09-30T03:30:51.437249994Z","published":"2026-09-28T04:30:10.101Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"4.1.1"},{"last_affected":"4.1.1"},{"introduced":"4.1.2"},{"last_affected":"4.1.2"},{"introduced":"4.1.3"},{"last_affected":"4.1.3"},{"introduced":"4.1.6"},{"last_affected":"4.1.6"},{"introduced":"4.1.10"},{"last_affected":"4.1.10"},{"introduced":"4.1.11"},{"last_affected":"4.1.11"},{"introduced":"4.1.12"},{"last_affected":"4.1.12"},{"introduced":"4.1.13"},{"last_affected":"4.1.13"},{"introduced":"4.1.14"},{"last_affected":"4.1.14"},{"introduced":"4.1.15"},{"last_affected":"4.1.15"},{"introduced":"4.1.16"},{"last_affected":"4.1.16"},{"introduced":"4.2.1"},{"last_affected":"4.2.1"},{"introduced":"4.2.2"},{"last_affected":"4.2.2"},{"introduced":"4.2.3"},{"last_affected":"4.2.3"},{"introduced":"4.2.6"},{"last_affected":"4.2.6"},{"introduced":"4.2.7"},{"last_affected":"4.2.7"},{"introduced":"4.2.8"},{"last_affected":"4.2.8"},{"introduced":"4.3.3"},{"last_affected":"4.3.3"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"VulDB","cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100909.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100909.json"},{"type":"ADVISORY","url":"https://github.com/octobercms/october/security/advisories/GHSA-2xmm-m4wv-3fjh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100909"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-100909"},{"type":"ADVISORY","url":"https://vuldb.com/submit/919993"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/410869"},{"type":"REPORT","url":"https://vuldb.com/vuln/410869/cti"},{"type":"FIX","url":"https://github.com/octobercms/october/commit/0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58"},{"type":"FIX","url":"https://github.com/octobercms/october/releases/tag/v4.3.5"},{"type":"EVIDENCE","url":"https://github.com/0xGenesi/CVE/blob/main/October_CMS_Stream_Wrapper_Injection.md"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/octobercms/october","events":[{"introduced":"141179aee18ed9f483d675183b51498d882f64a5"},{"fixed":"0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58"},{"fixed":"1024483d1e9ff04bf8b3b1ede7b02db018a385c7"}],"database_specific":{"extracted_events":[{"introduced":"4.1.0"},{"last_affected":"4.1.0"},{"introduced":"4.1.4"},{"last_affected":"4.1.4"},{"introduced":"4.1.5"},{"last_affected":"4.1.5"},{"introduced":"4.1.7"},{"last_affected":"4.1.7"},{"introduced":"4.1.8"},{"last_affected":"4.1.8"},{"introduced":"4.1.9"},{"last_affected":"4.1.9"},{"introduced":"4.1.17"},{"last_affected":"4.1.17"},{"introduced":"4.1.18"},{"last_affected":"4.1.18"},{"introduced":"4.1.19"},{"last_affected":"4.1.19"},{"introduced":"4.2.0"},{"last_affected":"4.2.0"},{"introduced":"4.2.4"},{"last_affected":"4.2.4"},{"introduced":"4.2.5"},{"last_affected":"4.2.5"},{"introduced":"4.2.9"},{"last_affected":"4.2.9"},{"introduced":"4.2.10"},{"last_affected":"4.2.10"},{"introduced":"4.2.11"},{"last_affected":"4.2.11"},{"introduced":"4.2.12"},{"last_affected":"4.2.12"},{"introduced":"4.2.13"},{"last_affected":"4.2.13"},{"introduced":"4.2.14"},{"last_affected":"4.2.14"},{"introduced":"4.2.15"},{"last_affected":"4.2.15"},{"introduced":"4.2.16"},{"last_affected":"4.2.16"},{"introduced":"4.2.17"},{"last_affected":"4.2.17"},{"introduced":"4.2.18"},{"last_affected":"4.2.18"},{"introduced":"4.2.19"},{"last_affected":"4.2.19"},{"introduced":"4.2.20"},{"last_affected":"4.2.20"},{"introduced":"4.2.21"},{"last_affected":"4.2.21"},{"introduced":"4.2.22"},{"last_affected":"4.2.22"},{"introduced":"4.2.23"},{"last_affected":"4.2.23"},{"introduced":"4.2.24"},{"last_affected":"4.2.24"},{"introduced":"4.2.25"},{"last_affected":"4.2.25"},{"introduced":"4.3.0"},{"last_affected":"4.3.0"},{"introduced":"4.3.1"},{"last_affected":"4.3.1"},{"introduced":"4.3.2"},{"last_affected":"4.3.2"},{"introduced":"4.3.4"},{"last_affected":"4.3.4"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["4.1.0","4.1.17","4.1.18","4.1.19","4.1.4","4.1.5","4.1.7","4.1.8","4.1.9","4.2.0","4.2.10","4.2.11","4.2.12","4.2.13","4.2.14","4.2.15","4.2.16","4.2.17","4.2.18","4.2.19","4.2.20","4.2.21","4.2.22","4.2.23","4.2.25","4.2.4","4.2.5","4.2.9","4.3.0","4.3.1","4.3.2","4.3.4","v4.3.4","v4.3.2","v4.3.1","v4.3.0","v4.2.25","v4.2.24","v4.2.23","v4.2.22","v4.2.21","v4.2.20","v4.2.19","v4.2.18","v4.2.17","v4.2.16","v4.2.15","v4.2.14","v4.2.13","v4.2.12","v4.2.11","v4.2.10","v4.2.9","v4.2.5","v4.2.4","v4.2.0","v4.1.19","v4.1.18","v4.1.17","v4.1.9","v4.1.8","v4.1.7","v4.1.5","v4.1.4","v4.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100909.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}