https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 18:52:32 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-292230 EUVD-2026-292230 https://cve.radiocsirt.org/vuln/euvd-2026-292230 https://cve.radiocsirt.org/vuln/fkie_cve-2026-26067 <p>October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft .less, .sass, or .scss files that leverage the compiler&#39;s import functionality to read arbitrary files from the server. This worked even with cms.safe_mode enabled. This vulnerability is fixed in 3.7.14 and 4.1.10.</p> <p>October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft .less, .sass, or .scss files that leverage the compiler&#39;s import functionality to read arbitrary files from the server. This worked even with cms.safe_mode enabled. This vulnerability is fixed in 3.7.14 and 4.1.10.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-26067 https://cve.radiocsirt.org/vuln/ghsa-3888-q23f-x7qh <p><strong>Affected:</strong> Packagist: october/system</p> <p>A server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft `.less`, `.sass`, or `.scss` files that leverage the compiler&#39;s import functionality to read arbitrary files from the server. This worked even with `cms.safe_mode` enabled.</p> <p>### Impact - Potential exposure of sensitive server-side files - Requires authenticated backend access with Editor permissions - Only relevant when `cms.safe_mode` is enabled (otherwise direct PHP injection is already possible)</p> <p>### Patches The vulnerability has been patched in v3.7.14 and v4.1.10. When `cms.safe_mode` is enabled, `.less`, `.sass`, and `.scss` files can no longer be created, uploaded, or edited across the CMS editor, media manager, and file upload interfaces. All users are encouraged to upgrade to the latest patched version.</p> <p>### Workarounds If upgrading immediately is not possible: - Set `cms.editable_asset_types` config to `[&#39;css&#39;, &#39;js&#39;]` to remove preprocessor file types from the editor - Restrict Editor tool access to fully trusted administrators only</p> <p>- Reported by [Chris Alupului](https://github.com/neosprings)</p> <p><strong>Affected:</strong> Packagist: october/system</p> <p>A server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft `.less`, `.sass`, or `.scss` files that leverage the compiler&#39;s import functionality to read arbitrary files from the server. This worked even with `cms.safe_mode` enabled.</p> <p>### Impact - Potential exposure of sensitive server-side files - Requires authenticated backend access with Editor permissions - Only relevant when `cms.safe_mode` is enabled (otherwise direct PHP injection is already possible)</p> <p>### Patches The vulnerability has been patched in v3.7.14 and v4.1.10. When `cms.safe_mode` is enabled, `.less`, `.sass`, and `.scss` files can no longer be created, uploaded, or edited across the CMS editor, media manager, and file upload interfaces. All users are encouraged to upgrade to the latest patched version.</p> <p>### Workarounds If upgrading immediately is not possible: - Set `cms.editable_asset_types` config to `[&#39;css&#39;, &#39;js&#39;]` to remove preprocessor file types from the editor - Restrict Editor tool access to fully trusted administrators only</p> <p>- Reported by [Chris Alupului](https://github.com/neosprings)</p> https://cve.radiocsirt.org/vuln/ghsa-3888-q23f-x7qh