{
  "affected": [
    {
      "affectedData": [
        {
          "product": "october",
          "vendor": "octobercms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.7.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.1.10"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A4B09756-5CEC-4A63-A91F-58E99350B445",
              "versionEndExcluding": "3.7.14",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2727354A-C459-499A-BE8A-3E397FC293F9",
              "versionEndExcluding": "4.1.10",
              "versionStartIncluding": "4.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a server-side information disclosure vulnerability in the INI settings parser. Because PHP\u0027s parse_ini_string() function supports ${} syntax for environment variable interpolation, attackers with Editor access could inject patterns such as ${APP_KEY} or ${DB_PASSWORD} into CMS page settings fields, causing sensitive environment variables to be resolved, stored in the template, and returned to the attacker when the page was reopened. This could enable exfiltration of credentials and secrets (database passwords, AWS keys, application keys), potentially leading to further attacks such as database access or cookie forgery. The vulnerability is only relevant when cms.safe_mode is enabled, as direct PHP injection is already possible otherwise. This issue has been fixed in versions 3.7.14 and 4.1.10. If users are unable to immediately upgrade, they can workaround this issue by restricting Editor tool access to fully trusted administrators only, and ensuring database and cloud service credentials are not accessible from the web server\u0027s network."
    },
    {
      "lang": "es",
      "value": "October es un Sistema de Gesti\u00f3n de Contenidos (CMS) y plataforma web. Las versiones anteriores a la 3.7.14 y 4.1.10 contienen una vulnerabilidad de revelaci\u00f3n de informaci\u00f3n del lado del servidor en el analizador de configuraciones INI. Debido a que la funci\u00f3n parse_ini_string() de PHP soporta la sintaxis ${} para la interpolaci\u00f3n de variables de entorno, los atacantes con acceso de Editor podr\u00edan inyectar patrones como ${APP_KEY} o ${DB_PASSWORD} en los campos de configuraci\u00f3n de las p\u00e1ginas del CMS, haciendo que las variables de entorno sensibles se resolvieran, se almacenaran en la plantilla y se devolvieran al atacante cuando la p\u00e1gina se volv\u00eda a abrir. Esto podr\u00eda permitir la exfiltraci\u00f3n de credenciales y secretos (contrase\u00f1as de base de datos, claves de AWS, claves de aplicaci\u00f3n), lo que podr\u00eda conducir a ataques adicionales como el acceso a la base de datos o la falsificaci\u00f3n de cookies. La vulnerabilidad solo es relevante cuando cms.safe_mode est\u00e1 habilitado, ya que la inyecci\u00f3n directa de PHP ya es posible de otra manera. Este problema ha sido solucionado en las versiones 3.7.14 y 4.1.10. Si los usuarios no pueden actualizar de inmediato, pueden solucionar este problema restringiendo el acceso a la herramienta de Editor solo a administradores de plena confianza y asegur\u00e1ndose de que las credenciales de la base de datos y los servicios en la nube no sean accesibles desde la red del servidor web."
    }
  ],
  "id": "CVE-2026-25125",
  "lastModified": "2026-07-25T11:10:00.100",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-25125",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-15T14:24:59.493377Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-14T21:16:25.163",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/octobercms/october/security/advisories/GHSA-g6v3-wv4j-x9hg"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}