Executive brief
October CMS's image resizer feature allows templates to resize and cache remote images. A weakness in URL validation allows non-HTTP schemes (like phar://, file://, ftp://) to be stored in the cache and later passed to the underlying image library. If a template author passes untrusted input to the resize filter without validation, an attacker could exploit PHP deserialization via phar:// URLs, potentially achieving code execution. This risk is limited to installations where templates accept and process user-supplied URLs.
Technical details
The vulnerability is an improper input validation weakness (CWE-20) in the ResizeImageItem::fromObject() method. The resizer classified external sources by checking if the string began with "http" and accepted any value containing "://" as a valid URL. This allows non-HTTP(S) PHP stream wrappers (phar://, file://, ftp://) to bypass scheme validation, be stored in the resizer cache, and later passed to the underlying image library. On phar:// paths, this can trigger metadata deserialization during file operations, potentially leading to RCE. Exploitation requires a pre-existing injection primitive—specifically, template-authoring or backend-configuration code that pipes untrusted input into the |resize Twig filter or ResizeImages::resize() API without validation. The public /resize/{file} route is a cache lookup and cannot be exploited directly by an unauthenticated user. The issue is fixed in version 4.3.5.
Affected products
- October CMS October >= 4.3.0, < 4.3.4
Timeline
- 2026-09-14: disclosed: October CMS Incomplete Scheme Validation vulnerability disclosed via GHSA-2xmm-m4wv-3fjh
- 2026-09-14: patched: Patch released in version 4.3.5