GHSA-2XMM-M4WV-3FJH: Incomplete Scheme Validation in October CMS Image Resizer
Vulnerability ID: GHSA-2XMM-M4WV-3FJH
CVSS Score: 3.9
Published: 2026-09-14
This report provides a technical analysis of GHSA-2XMM-M4WV-3FJH, an incomplete scheme validation vulnerability in the image resizing utility of October CMS. By exploiting this flaw, authenticated or privileged users can pass dangerous URI schemes to trigger deserialization of untrusted metadata.
TL;DR
A flaw in the October CMS image resizer allows processing of non-HTTP protocols, potentially leading to arbitrary code execution via PHAR deserialization.
Technical Details
- CWE ID: CWE-20, CWE-502
- Attack Vector: Network (AV:N)
- CVSS Score: 3.9 (Low)
- Exploit Status: PoC (Proof of Concept)
- KEV Status: Not Listed
- Impact: Untrusted Deserialization / Code Execution
Affected Systems
- October CMS (october/october package)
Mitigation Strategies
- Upgrade October CMS to version 4.3.5 or higher.
- Audit Twig templates to ensure no dynamic, user-controlled input is sent directly to the image resizer.
- Configure PHP to restrict or disable the phar:// stream wrapper.
Remediation Steps:
- Update the composer.json file to require 'october/october': '^4.3.5'.
- Run 'composer update october/october' in the environment.
- Verify the update by checking that 'ResizeImageItem::fromObject()' validates schemes using parse_url().
References
- GitHub Security Advisory GHSA-2xmm-m4wv-3fjh
- October CMS Primary Code Repository
- Advisory Database Reference
Read the full report for GHSA-2XMM-M4WV-3FJH on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)