October CMS incomplete URL scheme validation in image resizer

Severity: low · CVSS 3.9 · Published 2026-09-14

October CMS's image resizer feature allows templates to resize and cache remote images. A weakness in URL validation allows non-HTTP schemes (like phar://, file://, ftp://) to be stored in the cache and later passed to the underlying image library. If a template author passes untrusted input to the resize filter without validation, an attacker could exploit PHP deserialization via phar:// URLs, potentially achieving code execution. This risk is limited to installations where templates accept and process user-supplied URLs.

Technologies: october/october (Packagist). Vendors: Packagist.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Low severity, with a CVSS score of 3.9, published 14 September 2026.
Which products and versions are affected?
october/october (Packagist) >= 4.3.0, < 4.3.4.
Is there a fix for This vulnerability?
A patch was published on 2026-09-14: Patch released in version 4.3.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a web application.
Am I affected?
Check whether you run october/october (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper input validation weakness (CWE-20) in the ResizeImageItem::fromObject() method. The resizer classified external sources by checking if the string began with "http" and accepted any value containing "://" as a valid URL. This allows non-HTTP(S) PHP stream wrappers (phar://, file://, ftp://) to bypass scheme validation, be stored in the resizer cache, and later passed to the underlying image library. On phar:// paths, this can trigger metadata deserialization during file operations, potentially leading to RCE. Exploitation requires a pre-existing injection primitive—specifically, template-authoring or backend-configuration code that pipes untrusted input into the |resize Twig filter or ResizeImages::resize() API without validation. The public /resize/{file} route is a cache lookup and cannot be exploited directly by an unauthenticated user. The issue is fixed in version 4.3.5.

Affected products

  • October CMS October >= 4.3.0, < 4.3.4

Timeline

  • 2026-09-14: disclosed: October CMS Incomplete Scheme Validation vulnerability disclosed via GHSA-2xmm-m4wv-3fjh
  • 2026-09-14: patched: Patch released in version 4.3.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.