CVE-2026-100909

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed...

PT-2026-99767

Name of the Vulnerable Software and Affected Versions OctoberCMS versions prior to 4.1.20 OctoberCMS versions prior to 4.2.26 OctoberCMS versions prior to 4.3.5 Description A remote server-side request forgery exists due to the manipulation of the realSourcePath argument within the...