{ "affected": [ { "ranges": [ { "database_specific": { "extracted_events": [ { "introduced": "4.1.0" }, { "last_affected": "4.1.0" }, { "introduced": "4.1.4" }, { "last_affected": "4.1.4" }, { "introduced": "4.1.5" }, { "last_affected": "4.1.5" }, { "introduced": "4.1.7" }, { "last_affected": "4.1.7" }, { "introduced": "4.1.8" }, { "last_affected": "4.1.8" }, { "introduced": "4.1.9" }, { "last_affected": "4.1.9" }, { "introduced": "4.1.17" }, { "last_affected": "4.1.17" }, { "introduced": "4.1.18" }, { "last_affected": "4.1.18" }, { "introduced": "4.1.19" }, { "last_affected": "4.1.19" }, { "introduced": "4.2.0" }, { "last_affected": "4.2.0" }, { "introduced": "4.2.4" }, { "last_affected": "4.2.4" }, { "introduced": "4.2.5" }, { "last_affected": "4.2.5" }, { "introduced": "4.2.9" }, { "last_affected": "4.2.9" }, { "introduced": "4.2.10" }, { "last_affected": "4.2.10" }, { "introduced": "4.2.11" }, { "last_affected": "4.2.11" }, { "introduced": "4.2.12" }, { "last_affected": "4.2.12" }, { "introduced": "4.2.13" }, { "last_affected": "4.2.13" }, { "introduced": "4.2.14" }, { "last_affected": "4.2.14" }, { "introduced": "4.2.15" }, { "last_affected": "4.2.15" }, { "introduced": "4.2.16" }, { "last_affected": "4.2.16" }, { "introduced": "4.2.17" }, { "last_affected": "4.2.17" }, { "introduced": "4.2.18" }, { "last_affected": "4.2.18" }, { "introduced": "4.2.19" }, { "last_affected": "4.2.19" }, { "introduced": "4.2.20" }, { "last_affected": "4.2.20" }, { "introduced": "4.2.21" }, { "last_affected": "4.2.21" }, { "introduced": "4.2.22" }, { "last_affected": "4.2.22" }, { "introduced": "4.2.23" }, { "last_affected": "4.2.23" }, { "introduced": "4.2.24" }, { "last_affected": "4.2.24" }, { "introduced": "4.2.25" }, { "last_affected": "4.2.25" }, { "introduced": "4.3.0" }, { "last_affected": "4.3.0" }, { "introduced": "4.3.1" }, { "last_affected": "4.3.1" }, { "introduced": "4.3.2" }, { "last_affected": "4.3.2" }, { "introduced": "4.3.4" }, { "last_affected": "4.3.4" } ], "source": [ "AFFECTED_FIELD", "REFERENCES" ] }, "events": [ { "introduced": "141179aee18ed9f483d675183b51498d882f64a5" }, { "fixed": "0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58" }, { "fixed": "1024483d1e9ff04bf8b3b1ede7b02db018a385c7" } ], "repo": "https://github.com/octobercms/october", "type": "GIT" } ], "versions": [ "4.1.0", "4.1.17", "4.1.18", "4.1.19", "4.1.4", "4.1.5", "4.1.7", "4.1.8", "4.1.9", "4.2.0", "4.2.10", "4.2.11", "4.2.12", "4.2.13", "4.2.14", "4.2.15", "4.2.16", "4.2.17", "4.2.18", "4.2.19", "4.2.20", "4.2.21", "4.2.22", "4.2.23", "4.2.25", "4.2.4", "4.2.5", "4.2.9", "4.3.0", "4.3.1", "4.3.2", "4.3.4" ] } ], "aliases": [ "GHSA-2xmm-m4wv-3fjh" ], "database_specific": { "cna_assigner": "VulDB", "cwe_ids": [ "CWE-918" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100909.json", "unresolved_ranges": [ { "extracted_events": [ { "introduced": "4.1.1" }, { "last_affected": "4.1.1" }, { "introduced": "4.1.2" }, { "last_affected": "4.1.2" }, { "introduced": "4.1.3" }, { "last_affected": "4.1.3" }, { "introduced": "4.1.6" }, { "last_affected": "4.1.6" }, { "introduced": "4.1.10" }, { "last_affected": "4.1.10" }, { "introduced": "4.1.11" }, { "last_affected": "4.1.11" }, { "introduced": "4.1.12" }, { "last_affected": "4.1.12" }, { "introduced": "4.1.13" }, { "last_affected": "4.1.13" }, { "introduced": "4.1.14" }, { "last_affected": "4.1.14" }, { "introduced": "4.1.15" }, { "last_affected": "4.1.15" }, { "introduced": "4.1.16" }, { "last_affected": "4.1.16" }, { "introduced": "4.2.1" }, { "last_affected": "4.2.1" }, { "introduced": "4.2.2" }, { "last_affected": "4.2.2" }, { "introduced": "4.2.3" }, { "last_affected": "4.2.3" }, { "introduced": "4.2.6" }, { "last_affected": "4.2.6" }, { "introduced": "4.2.7" }, { "last_affected": "4.2.7" }, { "introduced": "4.2.8" }, { "last_affected": "4.2.8" }, { "introduced": "4.3.3" }, { "last_affected": "4.3.3" } ], "source": "AFFECTED_FIELD" } ] }, "details": "A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version 4.3.5 and 4.4.0 is sufficient to resolve this issue. The patch is identified as 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58. The affected component should be upgraded.", "id": "CVE-2026-100909", "modified": "2026-09-30T03:30:51.437249994Z", "published": "2026-09-28T04:30:10.101Z", "references": [ { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100909.json" }, { "type": "ADVISORY", "url": "https://github.com/octobercms/october/security/advisories/GHSA-2xmm-m4wv-3fjh" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100909" }, { "type": "ADVISORY", "url": "https://vuldb.com/cve/CVE-2026-100909" }, { "type": "ADVISORY", "url": "https://vuldb.com/submit/919993" }, { "type": "ADVISORY", "url": "https://vuldb.com/vuln/410869" }, { "type": "REPORT", "url": "https://vuldb.com/vuln/410869/cti" }, { "type": "FIX", "url": "https://github.com/octobercms/october/commit/0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58" }, { "type": "FIX", "url": "https://github.com/octobercms/october/releases/tag/v4.3.5" }, { "type": "EVIDENCE", "url": "https://github.com/0xGenesi/CVE/blob/main/October_CMS_Stream_Wrapper_Injection.md" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "type": "CVSS_V4" } ], "summary": "OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery" }