CVE-2026-26067

October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft .less, .sass, or .scss files that leverage the compiler's import functionality to read arbitrary files from the server. This worked even with cms.safe_mode enabled. This vulnerability is fixed in 3.7.14 and 4.1.10.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/octobercms/october/security/advisories/GHSA-3888-q23f-x7qh

Configurations

No configuration.

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) October es un Sistema de Gestión de Contenidos (CMS) y plataforma web. Antes de las versiones 3.7.14 y 4.1.10, fue identificada una vulnerabilidad de revelación de información del lado del servidor en el manejo de archivos de preprocesador CSS. Usuarios de backend con permisos de Editor podían crear archivos .less, .sass o .scss que aprovechan la funcionalidad de importación del compilador para leer archivos arbitrarios del servidor. Esto funcionaba incluso con cms.safe_mode habilitado. Esta vulnerabilidad está corregida en las versiones 3.7.14 y 4.1.10.

Information

Published : 2026-04-21 17:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-26067

Mitre link : CVE-2026-26067

CVE.ORG link : CVE-2026-26067

JSON object : View

Products Affected

No product.

CWE

CWE-184

Incomplete List of Disallowed Inputs

CWE-863

Incorrect Authorization

{"id": "CVE-2026-26067", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26067", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-21T17:35:10.591022Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "octobercms", "product": "october", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.1.10"}, {"status": "affected", "version": "< 3.7.14"}]}]}], "published": "2026-04-21T17:16:24.383", "references": [{"url": "https://github.com/octobercms/october/security/advisories/GHSA-3888-q23f-x7qh", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-184"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft .less, .sass, or .scss files that leverage the compiler's import functionality to read arbitrary files from the server. This worked even with cms.safe_mode enabled. This vulnerability is fixed in 3.7.14 and 4.1.10."}, {"lang": "es", "value": "October es un Sistema de Gesti\u00f3n de Contenidos (CMS) y plataforma web. Antes de las versiones 3.7.14 y 4.1.10, fue identificada una vulnerabilidad de revelaci\u00f3n de informaci\u00f3n del lado del servidor en el manejo de archivos de preprocesador CSS. Usuarios de backend con permisos de Editor pod\u00edan crear archivos .less, .sass o .scss que aprovechan la funcionalidad de importaci\u00f3n del compilador para leer archivos arbitrarios del servidor. Esto funcionaba incluso con cms.safe_mode habilitado. Esta vulnerabilidad est\u00e1 corregida en las versiones 3.7.14 y 4.1.10."}], "lastModified": "2026-10-26T22:10:00.163", "sourceIdentifier": "security-advisories@github.com"}