CVE-2026-101005

A server-side request forgery (SSRF) vulnerability exists in October CMS versions up to 4.3.4 . The flaw is located in the validateExternalImageHost function within the System/Classes/ResizeImages.php file of the SSRF Protection component. An unauthenticated remote attacker can exploit this vulne...

CVE-2026-101005 October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...

CVE-2026-101005 October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...

CVE-2026-101005 October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...

CVE-2026-100909

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed...

CVE-2026-100909 OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed...

CVE-2026-100909 OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed...

CVE-2026-100909

A server-side request forgery (SSRF) vulnerability exists in OctoberCMS versions up to 4.1.19/4.2.25/4.3.4 . The flaw is located in the getSourcePathForResize function within the modules/system/classes/ResizeImages.php file, where the manipulation of the realSourcePath argument allows for remote ...

CVE-2026-100909 OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed...

PT-2026-99770

Name of the Vulnerable Software and Affected Versions October CMS versions prior to 4.3.5 Description A server-side request forgery SSRF issue exists in the SSRF Protection component. The flaw is located within the validateExternalImageHost function of the System/Classes/ResizeImages.php file,...

CVE-2026-100909: Server-Side Request Forgery (SSRF)

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed...

PT-2026-99767

Name of the Vulnerable Software and Affected Versions OctoberCMS versions prior to 4.1.20 OctoberCMS versions prior to 4.2.26 OctoberCMS versions prior to 4.3.5 Description A remote server-side request forgery exists due to the manipulation of the realSourcePath argument within the...