{"id":"CVE-2026-26067","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-26067","summary":"October CMS has Safe Mode Bypass via CSS Preprocessor Compilers","details":"A server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft `.less`, `.sass`, or `.scss` files that leverage the compiler's import functionality to read arbitrary files from the server. This worked even with `cms.safe_mode` enabled.\n\n### Impact\n- Potential exposure of sensitive server-side files\n- Requires authenticated backend access with Editor permissions\n- Only relevant when `cms.safe_mode` is enabled (otherwise direct PHP injection is already possible)\n\n### Patches\nThe vulnerability has been patched in v3.7.14 and v4.1.10. When `cms.safe_mode` is enabled, `.less`, `.sass`, and `.scss` files can no longer be created, uploaded, or edited across the CMS editor, media manager, and file upload interfaces. All users are encouraged to upgrade to the latest patched version.\n\n### Workarounds\nIf upgrading immediately is not possible:\n- Set `cms.editable_asset_types` config to `['css', 'js']` to remove preprocessor file types from the editor\n- Restrict Editor tool access to fully trusted administrators only\n\n- Reported by [Chris Alupului](https://github.com/neosprings)","published":"2026-04-21T16:43:49Z","modified":"2026-05-05T15:59:59.427971Z","cvss":{"score":4.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"},"epss":{"score":0.00246,"percentile":0.16031,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"october/system","fixedVersion":"3.7.14"},{"ecosystem":"Packagist","name":"october/system","fixedVersion":"4.1.10"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/octobercms/october/security/advisories/GHSA-3888-q23f-x7qh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26067"},{"type":"PACKAGE","url":"https://github.com/octobercms/october"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-05-05T15:59:59.427971Z"}}