Server-Side Information Disclosure in October CMS
CVE-2026-25125

4.9MEDIUM

Key Information:

Vendor

Octobercms

Status
October
Vendor
CVE Published:
14 April 2026

What is CVE-2026-25125?

October CMS has a sever-side information disclosure vulnerability linked to its INI settings parser. Attackers with Editor access can craft payloads utilizing the ${} syntax for environment variable interpolation, leading to sensitive data exposure. This includes potentially revealing environment variables such as database passwords and application keys. The return of these secrets could facilitate further attacks like unauthorized database access or cookie forgery. This vulnerability only affects installations where the cms.safe_mode setting is enabled. Users are urged to upgrade to versions 3.7.14 or 4.1.10 to mitigate this risk. For those unable to upgrade immediately, it is advisable to limit Editor access to trusted administrators and ensure sensitive credentials are not reachable from the web server's network.

Affected Version(s)

october < 3.7.14 < 3.7.14

october >= 4.0.0, < 4.1.10 < 4.0.0, 4.1.10

References

https://github.com/octobercms/october/security/advisories...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.