October CMS CVE-2026-100909

Requires a pre-existing injection primitive in the calling code: a backend template author (Publisher or Developer role, already trusted with template code execution) or plugin must pipe untrusted input into the |resize Twig filter or ResizeImages::resize() API without validating that the scheme is http/https. Only then can a phar://, file://, or ftp:// source reach the resizer cache and be passed to the image library. Limiting factors: NOT exploitable against default templates or where |resize is applied only to trusted values (uploaded file models, theme assets, static URLs); the /resize/{file} route is a lookup only and an unauthenticated visitor cannot write an arbitrary source path into the cache. Fixed in v4.3.5/4.4.0; affected 4.1.x/4.2.x/4.3.0-4.3.4.

This is a high-CVSS-narrative but low-real-risk issue once cross-referenced. VulDB (source of CVE-2026-100909, ref 410869) assigns CVSS 4.0 6.9 with AV:N/AC:L/PR:N/UI:N and states 'the attack may be performed from remote,' implying unauthenticated network exploitation. The vendor's own GHSA advisory (GHSA-2xmm-m4wv-3fjh) directly contradicts this: it describes the flaw as incomplete scheme validation in the image resizer (phar://, file://, ftp:// wrappers accepted where only http(s) should be) and explicitly labels it 'a defense-in-depth hardening rather than an unauthenticated network-to-RCE path.' The /resize/{file} route is only a lookup against a cache entry written by trusted server-side code, and 'an unauthenticated visitor cannot cause an arbitrary source path to be written into that cache.' Exploitation requires a pre-existing injection primitive - a template author (Publisher/Developer backend role, already trusted with template code execution) piping untrusted input into the |resize Twig filter or ResizeImages::resize() API without scheme validation. SSVC exploitation status is 'proof-of-concept' (E:P in the vector), and a public POC exists (0xGenesi's October CMS Stream Wrapper Injection writeup), but there is no KEV listing and no evidence of active exploitation. Net: the VulDB PR:N/AC:L rating materially overstates real-world exploitability; the vendor framing (conditional, requires trusted-role injection mistake) is the more credible signal.

A backend template author (Publisher/Developer role) or a plugin builds a template that pipes untrusted, attacker-influenced string input into the |resize Twig filter without validating the scheme. An attacker supplies a phar:// (or file:///ftp://) source path, which is stored in the resizer cache and later handed to the underlying image library, triggering metadata deserialization on the phar path and enabling SSRF or, via a crafted phar, object-injection consequences. A public POC (0xGenesi) demonstrates the stream-wrapper injection technique, but it is not exploitable from the network without that pre-existing injection primitive in the calling code.