Server-Side Information Disclosure in October CMS by October
CVE-2026-26067

4.9MEDIUM

Key Information:

Vendor

Octobercms

Status
October
Vendor
CVE Published:
21 April 2026

What is CVE-2026-26067?

A vulnerability in the October CMS allows backend users with Editor permissions to exploit the handling of CSS preprocessor files. By crafting .less, .sass, or .scss files that utilize the compiler’s import functionality, these users can gain access to arbitrary files on the server, bypassing security measures even when cms.safe_mode is enabled. The issue has been addressed in versions 3.7.14 and 4.1.10.

Affected Version(s)

october >= 4.0.0, < 4.1.10 < 4.0.0, 4.1.10

october < 3.7.14 < 3.7.14

References

https://github.com/octobercms/october/security/advisories...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.