CVE-2026-25125

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25125", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-29T14:03:42.540Z", "datePublished": "2026-04-14T20:39:59.164Z", "dateUpdated": "2026-04-15T14:25:12.276Z"}, "containers": {"cna": {"title": "October CMS: Environment Variable Exfiltration via INI Parser Interpolation", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/octobercms/october/security/advisories/GHSA-g6v3-wv4j-x9hg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/octobercms/october/security/advisories/GHSA-g6v3-wv4j-x9hg"}], "affected": [{"vendor": "octobercms", "product": "october", "versions": [{"version": "< 3.7.14", "status": "affected"}, {"version": ">= 4.0.0, < 4.1.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T20:39:59.164Z"}, "descriptions": [{"lang": "en", "value": "October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a server-side information disclosure vulnerability in the INI settings parser. Because PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation, attackers with Editor access could inject patterns such as ${APP_KEY} or ${DB_PASSWORD} into CMS page settings fields, causing sensitive environment variables to be resolved, stored in the template, and returned to the attacker when the page was reopened. This could enable exfiltration of credentials and secrets (database passwords, AWS keys, application keys), potentially leading to further attacks such as database access or cookie forgery. The vulnerability is only relevant when cms.safe_mode is enabled, as direct PHP injection is already possible otherwise. This issue has been fixed in versions 3.7.14 and 4.1.10. If users are unable to immediately upgrade, they can workaround this issue by restricting Editor tool access to fully trusted administrators only, and ensuring database and cloud service credentials are not accessible from the web server's network."}], "source": {"advisory": "GHSA-g6v3-wv4j-x9hg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T14:24:59.493377Z", "id": "CVE-2026-25125", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T14:25:12.276Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25125", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T14:24:59.493377Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T14:25:07.166Z"}}], "cna": {"title": "October CMS: Environment Variable Exfiltration via INI Parser Interpolation", "source": {"advisory": "GHSA-g6v3-wv4j-x9hg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "octobercms", "product": "october", "versions": [{"status": "affected", "version": "< 3.7.14"}, {"status": "affected", "version": ">= 4.0.0, < 4.1.10"}]}], "references": [{"url": "https://github.com/octobercms/october/security/advisories/GHSA-g6v3-wv4j-x9hg", "name": "https://github.com/octobercms/october/security/advisories/GHSA-g6v3-wv4j-x9hg", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a server-side information disclosure vulnerability in the INI settings parser. Because PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation, attackers with Editor access could inject patterns such as ${APP_KEY} or ${DB_PASSWORD} into CMS page settings fields, causing sensitive environment variables to be resolved, stored in the template, and returned to the attacker when the page was reopened. This could enable exfiltration of credentials and secrets (database passwords, AWS keys, application keys), potentially leading to further attacks such as database access or cookie forgery. The vulnerability is only relevant when cms.safe_mode is enabled, as direct PHP injection is already possible otherwise. This issue has been fixed in versions 3.7.14 and 4.1.10. If users are unable to immediately upgrade, they can workaround this issue by restricting Editor tool access to fully trusted administrators only, and ensuring database and cloud service credentials are not accessible from the web server's network."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T20:39:59.164Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25125", "state": "PUBLISHED", "dateUpdated": "2026-04-15T14:25:12.276Z", "dateReserved": "2026-01-29T14:03:42.540Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-14T20:39:59.164Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "october", "vendor": "octobercms", "versions": [{"status": "affected", "version": "< 3.7.14"}, {"status": "affected", "version": ">= 4.0.0, < 4.1.10"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*", "matchCriteriaId": "A4B09756-5CEC-4A63-A91F-58E99350B445", "versionEndExcluding": "3.7.14", "vulnerable": true}, {"criteria": "cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*", "matchCriteriaId": "2727354A-C459-499A-BE8A-3E397FC293F9", "versionEndExcluding": "4.1.10", "versionStartIncluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a server-side information disclosure vulnerability in the INI settings parser. Because PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation, attackers with Editor access could inject patterns such as ${APP_KEY} or ${DB_PASSWORD} into CMS page settings fields, causing sensitive environment variables to be resolved, stored in the template, and returned to the attacker when the page was reopened. This could enable exfiltration of credentials and secrets (database passwords, AWS keys, application keys), potentially leading to further attacks such as database access or cookie forgery. The vulnerability is only relevant when cms.safe_mode is enabled, as direct PHP injection is already possible otherwise. This issue has been fixed in versions 3.7.14 and 4.1.10. If users are unable to immediately upgrade, they can workaround this issue by restricting Editor tool access to fully trusted administrators only, and ensuring database and cloud service credentials are not accessible from the web server's network."}, {"lang": "es", "value": "October es un Sistema de Gesti\u00f3n de Contenidos (CMS) y plataforma web. Las versiones anteriores a la 3.7.14 y 4.1.10 contienen una vulnerabilidad de revelaci\u00f3n de informaci\u00f3n del lado del servidor en el analizador de configuraciones INI. Debido a que la funci\u00f3n parse_ini_string() de PHP soporta la sintaxis ${} para la interpolaci\u00f3n de variables de entorno, los atacantes con acceso de Editor podr\u00edan inyectar patrones como ${APP_KEY} o ${DB_PASSWORD} en los campos de configuraci\u00f3n de las p\u00e1ginas del CMS, haciendo que las variables de entorno sensibles se resolvieran, se almacenaran en la plantilla y se devolvieran al atacante cuando la p\u00e1gina se volv\u00eda a abrir. Esto podr\u00eda permitir la exfiltraci\u00f3n de credenciales y secretos (contrase\u00f1as de base de datos, claves de AWS, claves de aplicaci\u00f3n), lo que podr\u00eda conducir a ataques adicionales como el acceso a la base de datos o la falsificaci\u00f3n de cookies. La vulnerabilidad solo es relevante cuando cms.safe_mode est\u00e1 habilitado, ya que la inyecci\u00f3n directa de PHP ya es posible de otra manera. Este problema ha sido solucionado en las versiones 3.7.14 y 4.1.10. Si los usuarios no pueden actualizar de inmediato, pueden solucionar este problema restringiendo el acceso a la herramienta de Editor solo a administradores de plena confianza y asegur\u00e1ndose de que las credenciales de la base de datos y los servicios en la nube no sean accesibles desde la red del servidor web."}], "id": "CVE-2026-25125", "lastModified": "2026-07-25T11:10:00.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25125", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-15T14:24:59.493377Z", "version": "2.0.3"}}]}, "published": "2026-04-14T21:16:25.163", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/octobercms/october/security/advisories/GHSA-g6v3-wv4j-x9hg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.7.14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.1.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "october", "source": "cna", "vendor": "octobercms"}, "product": "october", "vendor": "octobercms"}], "analysis": {"en": {"generated_at": "2026-04-14T22:51:13.182391+00:00", "value": {"mitigation_remediation": ["Upgrade OctoberCMS to version 3.7.14 or 4.1.10 where the issue is fixed.", "Restrict the Editor role so that only fully trusted administrators can edit page settings, eliminating the opportunity for malicious input.", "Ensure that sensitive credentials are not reachable from the web server\u2019s network or exposed through other configuration files."], "summary": {"action": "Apply Patch", "impact": "Information Disclosure (Environment Variable Exfiltration)"}, "threat_synthesis": {"affected_systems": "OctoberCMS (October CMS) versions earlier than 3.7.14 and 4.1.10 are affected when cms.safe_mode is enabled. The issue requires Editor role access and is confined to the settings parser in these CMS releases.", "description_and_impact": "The vulnerability allows an Editor to inject PHP INI variable patterns such as ${APP_KEY} or ${DB_PASSWORD} into page settings. PHP\u2019s parse_ini_string() resolves these patterns, causing the CMS to store and later return sensitive environment variables within a template. This results in the exfiltration of credentials and secrets like database passwords, AWS keys, and application keys, potentially enabling subsequent attacks such as database compromise or cookie forgery.", "risk_and_exploitability": "The CVSS score of 4.9 indicates a moderate risk. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires legitimate Editor access in a system running cms.safe_mode, after which an attacker can retrieve environment variables that may be used for further credential\u2011based attacks. The vulnerability does not grant arbitrary code execution."}}}}, "created": "2026-04-15T14:28:40.999103+00:00", "updated": "2026-04-15T14:41:09.770194+00:00", "vendors": ["octobercms", "octobercms$PRODUCT$october"]}