CVE-2026-26067 — Incomplete List of Disallowed Inputs in October

CWE-184 — Incomplete List of Disallowed InputsCWE-863 — Incorrect AuthorizationCWE-200 — Sensitive Information ExposureCWE-22 — Path Traversal3 documents3 sources
Severity
4.9MEDIUMNVD
EPSS
0.0%
top 84.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Octobercms OctoberOctober System
Timeline
PublishedApr 21

Description

October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft .less, .sass, or .scss files that leverage the compiler's import functionality to read arbitrary files from the server. This worked even with cms.safe_mode enabled. This vulnerability is fixed in 3.7.14 and 4.1.10.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 1.2 | Impact: 3.6

Affected Packages2 packages

▶Packagistoctober/system4.0.0 — 4.1.10+1
▶CVEListV5octobercms/october< 3.7.14+1

🔴Vulnerability Details

2
GHSA
October CMS has Safe Mode Bypass via CSS Preprocessor Compilers↗2026-04-21
▶
VulDB
October CMS up to 3.7.13/4.1.9 CSS Preprocessor File authorization↗2026-04-21
▶
CVE-2026-26067 — Incomplete List of Disallowed Inputs | cvebase