PT-2026-34002 · Unknown · October Cms

Published 2026-04-21 · Updated 2026-04-21 · CVE-2026-26067

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions October versions prior to 3.7.14 October versions prior to 4.1.10

Description An information disclosure issue exists in the handling of CSS preprocessor files. Backend users with Editor permissions can create .less, .sass, or .scss files that use the compiler import functionality to read arbitrary files from the server. This occurs regardless of whether cms.safe mode is enabled.

Recommendations Update to version 3.7.14. Update to version 4.1.10.

Fix

Incomplete List of Disallowed Inputs

Information Disclosure

Path traversal

Incorrect Authorization

Weakness Enumeration

CWE-184

CWE-200

CWE-22

CWE-863

Related Identifiers

CVE-2026-26067

GHSA-3888-Q23F-X7QH

Affected Products

October Cms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-26067 · Security Note
• https://osv.dev/vulnerability/GHSA-3888-q23f-x7qh · Vendor Advisory
• https://github.com/octobercms/october/security/advisories/GHSA-3888-q23f-x7qh · Note
• https://github.com/octobercms/october · Note
• https://twitter.com/CVEnew/status/2046636253018223098 · Twitter Post