GHSA-g6v3-wv4j-x9hg · Severity: medium · Ecosystem: composer — October Rain has Environment Variable Exfiltration via INI Parser Interpolation
October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a server-side information disclosure vulnerability in the INI settings parser. Because PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation, attackers with Editor access could inject patterns such as ${APP_KEY} or ${DB_PASSWORD} into CMS page settings fields, causing sensitive environment variables to be resolved, stored in the template, and returned to the attacker when the page was reopened. This could enable exfiltration of credentials and secrets (database passwords, AWS keys, application keys), potentially leading to further attacks such as database access or cookie forgery. The vulnerability is only relevant when cms.safe_mode is enabled, as direct PHP injection is already possible otherwise. This issue has been fixed in versions 3.7.14 and 4.1.10. If users are unable to immediately upgrade, they can workaround this issue by restricting Editor tool access to fully trusted administrators only, and ensuring database and cloud service credentials are not accessible from the web server's network.
Conclusion & alert: CVE-2026-25125 is rated Low Risk (28.4/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.33%). Mandatory action: Monitor for updates and reassess as exploit intelligence or EPSS changes.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.01% | 0.33% | +0.32% |
| 2 | 2026-04-15 | — | 0.01% | — |
Full EPSS history (2 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 4.9 | 3.1 | MEDIUM |
|
1.2 | 3.6 | [email protected] |
GHSA-g6v3-wv4j-x9hg · Severity: medium · Ecosystem: composer — October Rain has Environment Variable Exfiltration via INI Parser Interpolation
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| octobercms | october | < 3.7.14 | cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:* |
| octobercms | october | >= 4.0.0, < 4.1.10 | cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:* |
| URL | Tags |
|---|---|
| https://github.com/octobercms/october/security/advisories/GHSA-g6v3-wv4j-x9hg | Vendor Advisory |