CVE-2026-101005

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...

CVE-2026-100909

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed...

PT-2026-99767

Name of the Vulnerable Software and Affected Versions OctoberCMS versions prior to 4.1.20 OctoberCMS versions prior to 4.2.26 OctoberCMS versions prior to 4.3.5 Description A remote server-side request forgery exists due to the manipulation of the realSourcePath argument within the...