October CMS allows backend users with Editor permissions to upload .less, .sass, or .scss files that the compiler’s import feature processes. By specifying import paths, these files can read arbitrary files on the server, even when the safe_mode setting is enabled. The vulnerability is a server‑side information disclosure that enables an attacker to exfiltrate sensitive configuration, source code, or other private data without executing arbitrary code.

Octobercms October CMS versions earlier than 3.7.14 and 4.1.10 are affected. The issue is mitigated in October CMS 3.7.14 and 4.1.10 and later releases.

The CVSS score of 4.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a valid backend Editor account; an attacker who can upload a crafted preprocessor file can read any file the web server can access. The CVE data does not specify whether public exploitation has occurred, so the current exploitation status is unknown.