# CVE-2026-100909: OctoberCMS stream wrapper injection in ResizeImages

Source: https://junglewise.ai/threats/cve-2026-100909-a-vulnerability-was-found-in-octobercms-up-to-4-1-19-4-2-25-4-3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-100909 · Severity: high · CVSS 7.3 · Published 2026-09-28

OctoberCMS is a PHP-based content management system used to build and manage websites. The ResizeImages component has a vulnerability that allows attackers to inject PHP stream wrappers through the image resizing function, potentially leading to remote code execution. An attacker can exploit this by sending a specially crafted request to trigger deserialization of untrusted data, gaining full control of the server.

Vendors: [Octobercms](https://junglewise.ai/threats/vendors/octobercms).

## Quick answers

**Is CVE-2026-100909 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100909 being exploited in the wild.

**How severe is CVE-2026-100909?** High severity, with a CVSS score of 7.3, published 28 September 2026.

**Which products and versions are affected?** Octobercms October CMS 4.1.19, 4.2.25, 4.3.4 and earlier.

**Is there a fix for CVE-2026-100909?** A patch was published on 2026-08-14: Fix applied in commit 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58; patches available in versions 4.3.5 and 4.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100909 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-100909?** Check whether you run Octobercms October CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the getSourcePathForResize function of modules/system/classes/ResizeImages.php, where incomplete scheme validation allows PHP stream wrapper injection (CWE-918, CWE-22). The realSourcePath parameter is insufficiently validated, permitting an attacker to bypass path restrictions and inject stream wrappers like phar://. When the resizer processes the unvalidated path, it triggers PHP deserialization which can be exploited via POP gadget chains to achieve remote code execution.

## Affected products

- OctoberCMS October CMS 4.1.19, 4.2.25, 4.3.4 and earlier

## Timeline

- 2026-09-28: disclosed: Vulnerability disclosed publicly
- 2026-08-14: patched: Fix applied in commit 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58; patches available in versions 4.3.5 and 4.4.0

## References

- [https://github.com/0xGenesi/CVE/blob/main/October_CMS_Stream_Wrapper_Injection.md](https://github.com/0xGenesi/CVE/blob/main/October_CMS_Stream_Wrapper_Injection.md)
- [https://github.com/octobercms/october/commit/0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58](https://github.com/octobercms/october/commit/0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58)