SB2026091424 - Multiple vulnerabilities in October CMS

Description

This security bulletin contains information about 2 vulnerabilities.

1) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to perform server-side request forgery.

The vulnerability exists due to improper validation of IPv4-mapped IPv6 addresses in SystemClassesResizeImages::validateExternalImageHost() when processing external image URLs. A remote privileged user can supply an IPv4-mapped IPv6 URL to the image resizer to perform server-side request forgery.

User interaction is required to render a template that passes untrusted input to the |resize Twig filter or ResizeImages::resize() API.

2) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to trigger metadata deserialization.

The vulnerability exists due to improper scheme validation in the image resizer\'s ResizeImageItem::fromObject() string-source handling when processing untrusted string input passed to the |resize Twig filter or ResizeImages::resize() API. A remote privileged user can provide a phar:// source through untrusted input to trigger metadata deserialization.

Metadata deserialization can occur during subsequent file operations.

Remediation

Install update from vendor's website.

References

• https://github.com/octobercms/october/security/advisories/GHSA-j2j7-7m99-6226
• https://github.com/octobercms/october/security/advisories/GHSA-2xmm-m4wv-3fjh