CVE-2026-25125
Information Disclosure via INI Parser in October CMS Prior to
Publication date: 2026-04-14
Last updated on: 2026-04-22
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| octobercms | october | to 3.7.14 (exc) |
| octobercms | october | From 4.0.0 (inc) to 4.1.10 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows attackers with Editor access to exfiltrate sensitive environment variables such as database passwords, AWS keys, and application keys by injecting patterns into CMS page settings. The exposure of such sensitive information could lead to unauthorized access to databases and other critical systems.
The disclosure of sensitive credentials and secrets can result in violations of data protection regulations and standards like GDPR and HIPAA, which require the protection of personal and sensitive data. Unauthorized access enabled by this vulnerability could lead to breaches of confidentiality and integrity, potentially causing non-compliance with these regulations.
Mitigations include upgrading to fixed versions or restricting Editor access to trusted administrators and ensuring credentials are not accessible from the web server's network, which are important steps to maintain compliance.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, upgrade October CMS to version 3.7.14 or 4.1.10 or later, where the issue is fixed.
If upgrading is not possible right away, restrict Editor tool access to fully trusted administrators only.
Ensure that database and cloud service credentials are not accessible from the web server's network to reduce the risk of credential exfiltration.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves attackers with Editor access injecting environment variable patterns such as ${APP_KEY} or ${DB_PASSWORD} into CMS page settings fields, which then get resolved and exposed. Detection would involve monitoring for such suspicious patterns in CMS page settings or templates.
Since the vulnerability is related to the presence of these interpolation patterns in stored CMS settings, you can search the database or exported CMS configuration files for occurrences of ${...} patterns that reference environment variables.
- Use database queries to search for strings containing '${' in the CMS settings tables.
- For example, if you have access to the database, run a SQL query like: SELECT * FROM settings WHERE value LIKE '%${%';
- Check web server logs or CMS page templates for unexpected disclosure of environment variables.
There are no specific commands provided in the available information, but searching for the interpolation syntax '${...}' in CMS data or templates is a practical detection approach.
Can you explain this vulnerability to me?
This vulnerability exists in the October CMS platform versions prior to 3.7.14 and 4.1.10. It involves the INI settings parser which uses PHP's parse_ini_string() function that supports environment variable interpolation using the ${} syntax.
Attackers with Editor access can inject patterns like ${APP_KEY} or ${DB_PASSWORD} into CMS page settings fields. When the page is reopened, these environment variables are resolved and exposed, allowing the attacker to retrieve sensitive information such as database passwords, AWS keys, and application keys.
This vulnerability is specifically relevant when the cms.safe_mode setting is enabled, as otherwise direct PHP injection is already possible. It has been fixed in versions 3.7.14 and 4.1.10.
How can this vulnerability impact me? :
This vulnerability can lead to the disclosure of sensitive environment variables such as database passwords, AWS keys, and application keys.
An attacker with Editor access could exfiltrate these credentials and secrets, potentially enabling further attacks like unauthorized database access or cookie forgery.
If exploited, it could compromise the security of your web application and associated services.