High severity7.3NVD Advisory· Published Sep 28, 2026
CVE-2026-101005
CVE-2026-101005
Description
A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 4.3.5 is able to mitigate this issue. You should upgrade the affected component.
Affected products
1- Range: <=4.3.4
Patches
Vulnerability mechanics
References
8- github.com/0xGenesi/CVE/blob/main/October_CMS_SSRF_IPv6_Mapped_IPv4_Bypass.mdnvd
- github.com/octobercms/october/releases/tag/v4.3.5nvd
- github.com/octobercms/october/security/advisories/GHSA-j2j7-7m99-6226nvd
- vuldb.com/cve/CVE-2026-101005nvd
- vuldb.com/submit/922294nvd
- vuldb.com/vuln/410875nvd
- vuldb.com/vuln/410875/ctinvd
- www.cybersecurity-help.cz/vdb/vulns/149488/nvd
News mentions
0No linked articles in our index yet.