PT-2026-34002 · Octobercms · October

Published 2026-04-21 · Updated 2026-04-21 · CVE-2026-26067

Mitre

CVSS v3.1

4.9

Medium

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft .less, .sass, or .scss files that leverage the compiler's import functionality to read arbitrary files from the server. This worked even with cms.safe mode enabled. This vulnerability is fixed in 3.7.14 and 4.1.10.

Fix

Incomplete List of Disallowed Inputs

Incorrect Authorization

Weakness Enumeration

CWE-184

CWE-863

Related Identifiers

CVE-2026-26067

Affected Products

October

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-26067 · Security Note
• https://twitter.com/CVEnew/status/2046636253018223098 · Twitter Post
• https://github.com/octobercms/october/security/advisories/GHSA-3888-q23f-x7qh · Note