CVE-2026-101005

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-101005

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101005.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-101005

Aliases

GHSA-j2j7-7m99-6226

Published

2026-09-28T06:00:10Z

Modified

2026-09-30T03:46:53Z

Severity

5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery

Details

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 4.3.5 is able to mitigate this issue. You should upgrade the affected component.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-918"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101005.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "4.3.3"
                },
                {
                    "last_affected":  "4.3.3"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/octobercms/october

Affected ranges

Type

GIT

Repo

https://github.com/octobercms/october

Events

Introduced

1a8c0b1876185fc29b91df718e07eb5104827107

Fixed

1024483d1e9ff04bf8b3b1ede7b02db018a385c7

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "4.3.0"
        },
        {
            "last_affected":  "4.3.0"
        },
        {
            "introduced":  "4.3.1"
        },
        {
            "last_affected":  "4.3.1"
        },
        {
            "introduced":  "4.3.2"
        },
        {
            "last_affected":  "4.3.2"
        },
        {
            "introduced":  "4.3.4"
        },
        {
            "last_affected":  "4.3.4"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

4.*

4.3.0

4.3.1

4.3.2

4.3.4

v4.*

v4.3.0

v4.3.1

v4.3.2

v4.3.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101005.json"