CVE-2026-101005: October CMS SSRF Vulnerability

CVE-2026-101005 Overview

CVE-2026-101005 is a Server-Side Request Forgery (SSRF) vulnerability affecting October CMS versions up to and including 4.3.4. The flaw resides in the validateExternalImageHost function within System/Classes/ResizeImages.php, part of the SSRF Protection component. Attackers can bypass the host validation routine using IPv6-mapped IPv4 address notation, allowing remote requests to internal network resources. The exploit is publicly available, increasing exposure risk for unpatched installations. October CMS maintainers released version 4.3.5 to address this issue through GitHub Security Advisory GHSA-j2j7-7m99-6226.

Critical Impact
Remote, unauthenticated attackers can bypass SSRF filtering in October CMS to reach internal services and metadata endpoints via IPv6-mapped IPv4 addresses.

Affected Products

October CMS versions up to and including 4.3.4
System/Classes/ResizeImages.php component (SSRF Protection)
validateExternalImageHost function

Discovery Timeline

2026-09-28 - CVE-2026-101005 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-101005

Vulnerability Analysis

The vulnerability is classified under CWE-918 (Server-Side Request Forgery). October CMS implements SSRF defenses in the validateExternalImageHost method to prevent image resizing operations from targeting internal infrastructure. The protection enumerates disallowed hosts and private address ranges, blocking requests destined for loopback and RFC1918 networks.

The validation routine does not normalize IPv6-mapped IPv4 addresses before applying its denylist. An attacker can supply a host in the IPv6-mapped format (for example, ::ffff:127.0.0.1) that resolves to the same internal destination but evades string-based or IPv4-only range checks. The underlying HTTP client then establishes the connection to the resolved internal address, completing the SSRF.

Successful exploitation enables attackers to probe internal services, retrieve cloud metadata from endpoints such as 169.254.169.254, and interact with services otherwise unreachable from the internet. See the SSRF bypass guide for technical details.

Root Cause

The root cause is incomplete input normalization in validateExternalImageHost. The function evaluates host strings without canonicalizing IPv6-mapped IPv4 notation, so the denylist comparison fails to recognize equivalent internal addresses expressed in the mapped format.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker submits a crafted image URL containing an IPv6-mapped IPv4 host to any October CMS endpoint that invokes the image resizing logic. The server-side resizer then issues the outbound request on behalf of the attacker.

No verified exploit code is published in this record. Refer to the GitHub bypass writeup for the public proof-of-concept methodology.

Detection Methods for CVE-2026-101005

Indicators of Compromise

Outbound HTTP requests from the October CMS web server to internal RFC1918 ranges or link-local addresses such as 169.254.169.254.
Image resize requests containing hostnames in IPv6-mapped IPv4 notation (::ffff:a.b.c.d).
Application logs showing ResizeImages operations against unusual or non-public hosts.

Detection Strategies

Inspect web server access logs for image processing endpoints receiving URLs that embed IPv6-mapped IPv4 hosts.
Correlate outbound connections initiated by the PHP-FPM or web worker process against an allowlist of expected external image sources.
Monitor cloud metadata service access from application tier instances, which should be rare and investigated when observed.

Monitoring Recommendations

Enable egress logging on hosts running October CMS and alert on connections to loopback, link-local, and private address space.
Baseline normal outbound destinations for the image resizing subsystem and alert on deviations.
Centralize application and network telemetry in a SIEM to join request payloads with downstream connection metadata.

How to Mitigate CVE-2026-101005

Immediate Actions Required

Upgrade October CMS to version 4.3.5 or later as published in the v4.3.5 release notes.
Audit application logs for prior exploitation attempts targeting the image resizing endpoints.
Restrict outbound network access from the web tier to only required external destinations.

Patch Information

The maintainers address the vulnerability in October CMS 4.3.5. Details are available in GitHub Security Advisory GHSA-j2j7-7m99-6226 and the VulDB entry for CVE-2026-101005. Upgrading the affected component is the recommended remediation.

Workarounds

Block outbound traffic from the web server to internal subnets and the cloud metadata endpoint using host or network firewalls.
Place the application behind an egress proxy that enforces an allowlist of permitted external image hosts.
Disable or restrict the external image resizing functionality until patching is complete.

bash

# Upgrade October CMS to the patched release
composer require october/all:^4.3.5
php artisan october:update

# Example iptables egress restriction (block cloud metadata)
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 -p tcp -j REJECT