What is the CVSS score of CVE-2026-25125?

CVE-2026-25125 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-25125?

Yes, a patch is available for CVE-2026-25125. Update the affected software to the latest version immediately.

PHP CVE-2026-25125

EUVD-2026-22704 MEDIUM

Information Exposure (CWE-200)

2026-04-14 GitHub_M

GHSA-g6v3-wv4j-x9hg

PHP Information Disclosure

4.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 15, 2026 - 02:30 nvd

Patch available

Analysis Generated

Apr 14, 2026 - 22:43 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 21:16 euvd

EUVD-2026-22704

Analysis Generated

Apr 14, 2026 - 21:16 vuln.today

CVE Published

Apr 14, 2026 - 20:39 nvd

MEDIUM 4.9

DescriptionGitHub Advisory

October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a server-side information disclosure vulnerability in the INI settings parser. Because PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation, attackers with Editor access could inject patterns such as ${APP_KEY} or ${DB_PASSWORD} into CMS page settings fields, causing sensitive environment variables to be resolved, stored in the template, and returned to the attacker when the page was reopened. This could enable exfiltration of credentials and secrets (database passwords, AWS keys, application keys), potentially leading to further attacks such as database access or cookie forgery. The vulnerability is only relevant when cms.safe_mode is enabled, as direct PHP injection is already possible otherwise. This issue has been fixed in versions 3.7.14 and 4.1.10. If users are unable to immediately upgrade, they can workaround this issue by restricting Editor tool access to fully trusted administrators only, and ensuring database and cloud service credentials are not accessible from the web server's network.

AnalysisAI

October CMS versions prior to 3.7.14 and 4.1.10 allow authenticated editors to disclose sensitive environment variables through PHP's parse_ini_string() interpolation syntax in page settings fields. An attacker with Editor access can inject patterns like ${APP_KEY} or ${DB_PASSWORD} into CMS configuration fields, causing the server to resolve and expose database passwords, AWS credentials, and application keys, potentially enabling database compromise or session forgery. The vulnerability is limited to installations with cms.safe_mode enabled; CVSS 4.9 reflects high confidentiality impact but requires elevated privileges (PR:H) to exploit.

Technical ContextAI

October CMS uses PHP's parse_ini_string() function to parse INI-formatted settings stored in page configuration fields. The parse_ini_string() function, when parsing INI syntax, automatically interpolates environment variables referenced using ${VARIABLE_NAME} notation. This is a documented PHP feature intended for variable substitution, but becomes a security issue when untrusted user input (from authenticated editors) is passed directly to this parser without sanitization. The vulnerability is rooted in CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and occurs because user-controlled settings data is processed by a function that resolves sensitive system variables. The cms.safe_mode setting is relevant because when disabled, October already prevents arbitrary PHP injection; when enabled, it restricts code execution but does not prevent INI variable interpolation, creating this specific disclosure path.

RemediationAI

Vendor-released patch: October 3.7.14 or October 4.1.10 and later. Organizations should upgrade to these versions immediately. For teams unable to upgrade immediately, implement access controls restricting Editor tool permissions to a minimal set of fully trusted administrators only, verify that database credentials, API keys, and cloud service credentials are not accessible from environment variables that the web server process can read, and consider temporarily disabling cms.safe_mode if Editor access cannot be restricted (though this changes the security model). Apply the patch as soon as feasible per the GitHub security advisory at https://github.com/octobercms/october/security/advisories/GHSA-g6v3-wv4j-x9hg.