Is CVE-2026-100909 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100909 being exploited in the wild.

How severe is CVE-2026-100909?

High severity, with a CVSS score of 7.3, published 28 September 2026.

Which products and versions are affected?

Octobercms October CMS 4.1.19, 4.2.25, 4.3.4 and earlier.

Is there a fix for CVE-2026-100909?

A patch was published on 2026-08-14: Fix applied in commit 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58; patches available in versions 4.3.5 and 4.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100909 attacked?

It is attacked over the network.

Am I affected by CVE-2026-100909?

Check whether you run Octobercms October CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100909: OctoberCMS stream wrapper injection in ResizeImages

CVE-2026-100909 · Severity: high · CVSS 7.3 · Published 2026-09-28

OctoberCMS is a PHP-based content management system used to build and manage websites. The ResizeImages component has a vulnerability that allows attackers to inject PHP stream wrappers through the image resizing function, potentially leading to remote code execution. An attacker can exploit this by sending a specially crafted request to trigger deserialization of untrusted data, gaining full control of the server.

Vendors: Octobercms.

Quick answers

Is CVE-2026-100909 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100909 being exploited in the wild.
How severe is CVE-2026-100909?: High severity, with a CVSS score of 7.3, published 28 September 2026.
Which products and versions are affected?: Octobercms October CMS 4.1.19, 4.2.25, 4.3.4 and earlier.
Is there a fix for CVE-2026-100909?: A patch was published on 2026-08-14: Fix applied in commit 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58; patches available in versions 4.3.5 and 4.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100909 attacked?: It is attacked over the network.
Am I affected by CVE-2026-100909?: Check whether you run Octobercms October CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the getSourcePathForResize function of modules/system/classes/ResizeImages.php, where incomplete scheme validation allows PHP stream wrapper injection (CWE-918, CWE-22). The realSourcePath parameter is insufficiently validated, permitting an attacker to bypass path restrictions and inject stream wrappers like phar://. When the resizer processes the unvalidated path, it triggers PHP deserialization which can be exploited via POP gadget chains to achieve remote code execution.

Affected products

OctoberCMS October CMS 4.1.19, 4.2.25, 4.3.4 and earlier

Timeline

2026-09-28: disclosed: Vulnerability disclosed publicly
2026-08-14: patched: Fix applied in commit 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58; patches available in versions 4.3.5 and 4.4.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.