CVE-2026-25125: October Rain Environment Variable Exfiltration via INI Parser Interpolation
Summary
CVE-2026-25125: October Rain has Environment Variable Exfiltration via INI Parser Interpolation. Affects october/rain across 2 version ranges.
< 3.7.14
>= 4.0.0, < 4.1.10
Fixed in 3.7.14 or 4.1.10, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
October Rain is a popular open-source content management system (CMS) built on the PHP framework. It allows developers to create and manage websites with ease, offering features such as templating, plugin support, and a user-friendly interface. However, a vulnerability has been identified in its INI settings parser, which can lead to the exfiltration of sensitive environment variables.
Vulnerability Detail
A server-side information disclosure vulnerability exists in the INI settings parser of October Rain. The PHP function parse_ini_string() supports ${} syntax for environment variable interpolation. Attackers with Editor access can inject patterns like ${APP_KEY} or ${DB_PASSWORD} into CMS page settings. When the page is reopened, these sensitive environment variables are resolved and returned to the attacker, leading to potential database access, cookie forgery, or unauthorized access to cloud resources. This vulnerability requires authenticated backend access with Editor permissions and is only relevant when cms.safe_mode is enabled.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.7.143.7.14composer require october/rain:3.7.14 -
>= 4.0.0, < 4.1.104.1.10composer require october/rain:4.1.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not possible, restrict Editor tool access to fully trusted administrators only. Additionally, ensure that database and cloud service credentials are not accessible from the web server's network.
Conclusion
The vulnerability CVE-2026-25125 in October Rain poses a significant risk by allowing the exfiltration of sensitive environment variables. Users are strongly encouraged to upgrade to the patched versions to mitigate this risk. Implementing the suggested workarounds can provide additional security until an upgrade is possible.
See every vulnerability recorded for october/rain →
FAQ
CVE-2026-25125 is a vulnerability in October Rain that allows attackers to exfiltrate sensitive environment variables through the INI parser.
Any user of October Rain with Editor access who has not upgraded to the patched versions (v3.7.14 or v4.1.10) is at risk.
The vulnerability can lead to the exfiltration of sensitive information such as database credentials and API keys, potentially enabling further attacks.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for this vulnerability is 4.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for october/rain.
