October CMS CVE-2026-101005

Exploitation requires that October CMS's external image-resizing feature (ResizeImages / validateExternalImageHost SSRF protection) be reachable and processing attacker-supplied external image URLs - this is the standard code path for remote image handling. The specific bypass requires crafting a host as an IPv6-mapped IPv4 address to evade the validateExternalImageHost allow/deny check per the public POC. No authentication is required (PR:N) and no user interaction (UI:N). Limiting factors: impact is constrained to what the SSRF can reach and read back (VC:L/VI:L/VA:L, i.e. largely blind/limited SSRF, not RCE); realistic damage depends on the server's network position (presence of exploitable internal services or a cloud metadata endpoint); and instances already on v4.3.5+ are not affected.

This is a genuine but low-to-moderate priority issue. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated, low-complexity access, but all impact metrics are LOW (VC:L/VI:L/VA:L), yielding a medium score of 5.5 - consistent with a blind/limited SSRF rather than full internal compromise. Critically, this is NOT a net-new attack surface but a BYPASS of October CMS's existing SSRF protection: the validateExternalImageHost filter can be defeated using IPv6-mapped IPv4 addresses, so environments relying on that control for internal-network safety are the ones actually at risk. Exploitation status per input: publicly available exploit code exists (POC=YES, E:P Proof-of-Concept), but this is NOT confirmed active exploitation - no CISA KEV listing and no EPSS score provided. Signals are consistent (no conflicts): public POC + patched + low technical impact means opportunistic scanning is plausible but mass weaponization is unlikely given the constrained impact. Treat as a routine-to-prompt patch, not an emergency.

An unauthenticated remote attacker submits an external image URL to October CMS's image-resize functionality using an IPv6-mapped IPv4 address (e.g. ::ffff:169.254.169.254 or ::ffff:127.0.0.1) that slips past the validateExternalImageHost host check. The server then fetches that internal/loopback resource on the attacker's behalf, enabling internal service probing or cloud-metadata reach. A public POC (0xGenesi, 'October CMS SSRF IPv6-Mapped IPv4 Bypass') documents the exact technique.