CVE-2026-100909: OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery
A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version 4.3.5 and 4.4.0 is sufficient to resolve this issue. The patch is identified as 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58. The affected component should be upgraded.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OctoberCMSto a version that resolves this vulnerability.Fixed in 4.3.5 - Upgrade
Upgrade
OctoberCMSto a version that resolves this vulnerability.Fixed in 4.4.0
Event History
Frequently Asked Questions
Which OctoberCMS versions need to be upgraded?
OctoberCMS versions up to 4.1.19, 4.2.25, and 4.3.4 are affected. Upgrading to 4.3.5 or 4.4.0 resolves the issue.
Can this be exploited without authentication or user interaction?
Yes. The stated attack vector is network-based, with low complexity, no privileges required, and no user interaction required.
Is public exploit information available?
Yes. The exploit has been made public and could be used.
What code change addresses the issue?
The identified patch is 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58. The affected component should be upgraded.