# CVE-2026-26067: system Info Disclosure — Fixed in 3.7.14

🐘

🐘 Packagist

Not in CISA KEV

MEDIUM severity

# CVE-2026-26067 — system

MEDIUM 

CVE-2026-26067 is a medium-severity (CVSS 4.9) CWE-184 vulnerability in october/system. A fix is available for october/system — see the affected versions and patch details below.

October CMS has Safe Mode Bypass via CSS Preprocessor Compilers

Published

Apr 21, 2026

Updated

May 5, 2026

Affected

2 pkgs

Patched

2 / 2

Exploits

None indexed

Exploitation data as of Nov 8, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Exploitation Status

### No confirmed exploitation observed yet

-   CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-26067.

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

0.2%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs16th percentile — riskier than 16% of all scored CVEsHighest risk

0.00%0.31%0.61%0.92%0.0%0.2%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## How urgent is this, really

## Where this sits among everything scored

## Real-World Exposure

2 pkgs affected

🐘`october/system`🐘`october/system`

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

## Description

A server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft `.less`, `.sass`, or `.scss` files that leverage the compiler's import functionality to read arbitrary files from the server. This worked even with `cms.safe_mode` enabled.

#### Impact

-   Potential exposure of sensitive server-side files
-   Requires authenticated backend access with Editor permissions
-   Only relevant when `cms.safe_mode` is enabled (otherwise direct PHP injection is already possible)

#### Patches

The vulnerability has been patched in v3.7.14 and v4.1.10. When `cms.safe_mode` is enabled, `.less`, `.sass`, and `.scss` files can no longer be created, uploaded, or edited across the CMS editor, media manager, and file upload interfaces. All users are encouraged to upgrade to the latest patched version.

#### Workarounds

If upgrading immediately is not possible:

-   Set `cms.editable_asset_types` config to `['css', 'js']` to remove preprocessor file types from the editor
    
-   Restrict Editor tool access to fully trusted administrators only
    
-   Reported by [Chris Alupului](https://github.com/neosprings)
    

## Affected Packages

2 total 2 fixed

Ecosystem

Package

Vulnerable range

Fix

🐘Packagist

`october/system` 

all versions

3.7.14`composer require october/system:^3.7.14`

🐘Packagist

`october/system` 

≥ 4.0.0&&< 4.1.10

4.1.10`composer require october/system:^4.1.10`

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for october/system, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update october/system to 3.7.14 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-26067 is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
    

## Frequently Asked Questions

A server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft \`.less\`, \`.sass\`, or \`.scss\` files that leverage the compiler's import functionality to read arbitrary files from the server. This worked even with \`cms.safe\_mode\` enabled. ### Impact - Potential exposure of sensitive server-side files - Requires authenticated backend access with Editor permissions - Only relevant when \`cms.safe\_mode\` is enabled (otherwise direct PHP injection is already possible) ### Patches The vulnerability has been

O3 Security · Impact-Aware SCA

### Is CVE-2026-26067 in your dependencies?

Find it across Packagist, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)