CVE-2026-100909: OctoberCMS SSRF Vulnerability

CVE-2026-100909 Overview

CVE-2026-100909 is a server-side request forgery (SSRF) vulnerability in OctoberCMS versions up to 4.1.19, 4.2.25, and 4.3.4. The flaw resides in the getSourcePathForResize function of modules/system/classes/ResizeImages.php. Attackers can manipulate the realSourcePath argument to coerce the server into issuing crafted requests to arbitrary destinations. The exploit has been publicly disclosed and can be launched remotely without authentication. The issue is tracked under [CWE-918] and is resolved in OctoberCMS 4.3.5 and 4.4.0 via commit 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58.

Critical Impact
Unauthenticated remote attackers can abuse the image resize handler to issue server-side requests to internal networks, cloud metadata services, or arbitrary external endpoints.

Affected Products

OctoberCMS versions up to and including 4.1.19
OctoberCMS versions up to and including 4.2.25
OctoberCMS versions up to and including 4.3.4

Discovery Timeline

2026-09-28 - CVE-2026-100909 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100909

Vulnerability Analysis

The vulnerability lives in OctoberCMS's image resizing subsystem. The getSourcePathForResize function in modules/system/classes/ResizeImages.php accepts a realSourcePath argument used to locate the image to be processed. Insufficient validation on this input allows attackers to supply crafted path or URL values that the server dereferences during the resize operation. This behavior enables stream wrapper injection, which the public writeup describes in the GitHub CVE Stream Wrapper Injection advisory. The resulting SSRF primitive can be used to probe internal services, read local resources, or interact with cloud metadata endpoints depending on deployment context.

Root Cause

The root cause is missing validation of the realSourcePath argument before it is passed to PHP file-handling routines. Because PHP honors protocol stream wrappers (for example http://, ftp://, phar://) in file-oriented functions, attacker-controlled values can redirect I/O operations away from the intended local filesystem path. This classifies as [CWE-918] Server-Side Request Forgery.

Attack Vector

The attack is executed over the network with no authentication and no user interaction. An attacker crafts a request to an endpoint that reaches the vulnerable resize code path and supplies a manipulated source path. The server then issues the request on the attacker's behalf, returning or acting on content from the specified destination.

See the GitHub Security Advisory GHSA-2xmm-m4wv-3fjh and the VulDB CVE-2026-100909 entry for additional background.

php

// Patch excerpt - modules/backend/classes/Controller.php
$ownMethod = method_exists($this, $name);
if ($ownMethod) {
    $methodInfo = new \ReflectionMethod($this, $name);
    if (strtolower($methodInfo->getName()) !== $methodInfo->getName()) {
        return false;
    }

    $public = $methodInfo->isPublic();
    if ($public) {
        return true;
    }
}
elseif (strtolower($name) !== $name) {
    return false;
}

if ($internal && (($ownMethod && $methodInfo->isProtected()) || !$ownMethod)) {
    return true;

Source: OctoberCMS commit 0e9736a

Detection Methods for CVE-2026-100909

Indicators of Compromise

Outbound HTTP, FTP, or phar:// requests originating from the PHP worker process that handles the OctoberCMS image resize endpoint.
Web server access logs showing requests to resize URLs containing URL-encoded protocol handlers in path parameters.
Unexpected connections from the OctoberCMS host to internal RFC1918 addresses or cloud metadata IPs such as 169.254.169.254.

Detection Strategies

Inspect web application logs for requests to image resize endpoints with suspicious source, path, or URL-like parameters.
Correlate the OctoberCMS process with outbound network connections that do not match the expected destinations for a CMS workload.
Monitor PHP error logs for stream wrapper errors or failed file_get_contents calls referencing remote schemes.

Monitoring Recommendations

Alert on any PHP-FPM or web worker initiating connections to cloud instance metadata services.
Baseline egress traffic from the CMS tier and flag deviations, particularly short-lived connections to unusual ports.
Enable verbose logging on the OctoberCMS backend during triage to capture the full realSourcePath value supplied by clients.

How to Mitigate CVE-2026-100909

Immediate Actions Required

Upgrade OctoberCMS to version 4.3.5 or 4.4.0 as described in the OctoberCMS Release v4.3.5 notes.
Apply commit 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58 if an immediate full upgrade is not feasible.
Restrict egress traffic from the CMS host to only required destinations, blocking access to internal subnets and metadata endpoints.

Patch Information

The fix is delivered in OctoberCMS 4.3.5 and 4.4.0. The upstream patch is identified by commit hash 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58 and is published in the OctoberCMS Commit Update. Operators should verify the installed version using the OctoberCMS admin console or Composer lockfile after upgrade.

Workarounds

Place a reverse proxy or WAF rule in front of OctoberCMS that strips protocol handlers (http://, https://, ftp://, phar://, php://) from image resize parameters.
Deny outbound traffic from the OctoberCMS host to cloud metadata IP ranges and internal management subnets.
Disable or restrict access to backend image resize endpoints for unauthenticated users until the patch is applied.

bash

# Upgrade OctoberCMS via Composer
composer require october/system:^4.3.5 --update-with-dependencies
composer require october/backend:^4.3.5 --update-with-dependencies
composer require october/cms:^4.3.5 --update-with-dependencies
php artisan october:update
php artisan cache:clear