CVE-2026-101005
Received Received - Intake

Server-Side Request Forgery in October CMS

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: VulDB

Description
A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 4.3.5 is able to mitigate this issue. You should upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-101005
EUVD
EUVD-2026-88093

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
october cms to 4.3.5 (exc)
october cms to 4.3.3 (inc)
october cms to 4.3.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-101005 is a Server-Side Request Forgery (SSRF) vulnerability in October CMS versions up to 4.3.4. It affects the validateExternalImageHost function in System/Classes/ResizeImages.php. The vulnerability allows bypassing SSRF protections by using IPv4 addresses encoded as IPv6-mapped IPv4 addresses (e.g., ::ffff:127.0.0.1). This lets attackers access internal network resources or cloud metadata services by crafting malicious URLs.

Detection Guidance

Check October CMS version with: composer show october/october. If version is below 4.3.5, the system is vulnerable. Review logs for requests to /resize/{file} with IPv6-mapped IPv4 addresses like [::ffff:127.0.0.1] or [::ffff:169.254.169.254].

Impact Analysis

An attacker could exploit this to access internal services, localhost, private networks, or cloud metadata endpoints (like AWS/GCP/Azure metadata services). This may lead to unauthorized data access, service disruption, or further attacks within your network. Exploitation requires user interaction, such as submitting a crafted URL to a vulnerable image field or Twig filter.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. If exploited, it may result in data breaches, unauthorized disclosure of personal or health information, and non-compliance with data protection regulations. Organizations must patch to mitigate risks.

Mitigation Strategies

Upgrade October CMS to version 4.3.5 or later immediately. Review templates for untrusted input passed to |resize filter or ResizeImages::resize(). Block outbound traffic to sensitive ranges if upgrade is delayed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101005. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart