CVE-2026-100909

Name of the Vulnerable Software and Affected Versions OctoberCMS versions prior to 4.1.20 OctoberCMS versions prior to 4.2.26 OctoberCMS versions prior to 4.3.5

Description A remote server-side request forgery exists due to the manipulation of the realSourcePath argument within the getSourcePathForResize() function of the modules/system/classes/ResizeImages.php file. Server-side request forgery is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations Upgrade to version 4.3.5. Upgrade to version 4.4.0. As a temporary mitigation, restrict access to the getSourcePathForResize() function.