PT-2026-32911 · Unknown+1 · October Cms+1

Ptt · Published 2026-04-14 · Updated 2026-04-15 · CVE-2026-25125

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions October versions prior to 3.7.14 October versions prior to 4.1.10

Description An information disclosure issue exists in the INI settings parser. The parse ini string() function in PHP supports ${} syntax for environment variable interpolation. Users with Editor access can inject patterns such as ${APP KEY} or ${DB PASSWORD} into CMS page settings fields. This causes sensitive environment variables to be resolved, stored in the template, and returned to the attacker upon reopening the page, potentially leading to the exfiltration of database passwords, AWS keys, and application keys. This may further enable database access or cookie forgery. This issue is specifically relevant when the cms.safe mode variable is enabled.

Recommendations Update to version 3.7.14. Update to version 4.1.10. Restrict Editor tool access to fully trusted administrators only. Ensure database and cloud service credentials are not accessible from the web server network.

Fix

Information Disclosure

Code Injection

Weakness Enumeration

CWE-200

CWE-94

Related Identifiers

CVE-2026-25125

GHSA-G6V3-WV4J-X9HG

Affected Products

October Cms

Php

References · 5

• https://github.com/octobercms/october/security/advisories/GHSA-g6v3-wv4j-x9hg · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g6v3-wv4j-x9hg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25125 · Security Note
• https://github.com/octobercms/october · Note
• https://twitter.com/CVEnew/status/2044338934004752546 · Twitter Post