CVE-2026-26067

{
  "id": "CVE-2026-26067",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-21T17:16:24.383",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft .less, .sass, or .scss files that leverage the compiler's import functionality to read arbitrary files from the server. This worked even with cms.safe_mode enabled. This vulnerability is fixed in 3.7.14 and 4.1.10."
    },
    {
      "lang": "es",
      "value": "October es un Sistema de Gestión de Contenidos (CMS) y plataforma web. Antes de las versiones 3.7.14 y 4.1.10, fue identificada una vulnerabilidad de revelación de información del lado del servidor en el manejo de archivos de preprocesador CSS. Usuarios de backend con permisos de Editor podían crear archivos .less, .sass o .scss que aprovechan la funcionalidad de importación del compilador para leer archivos arbitrarios del servidor. Esto funcionaba incluso con cms.safe_mode habilitado. Esta vulnerabilidad está corregida en las versiones 3.7.14 y 4.1.10."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "octobercms",
          "product": "october",
          "versions": [
            {
              "version": ">= 4.0.0, < 4.1.10",
              "status": "affected"
            },
            {
              "version": "< 3.7.14",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 4.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-21T17:35:10.591022Z",
          "id": "CVE-2026-26067",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-184"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/octobercms/october/security/advisories/GHSA-3888-q23f-x7qh",
      "source": "[email protected]"
    }
  ]
}