{"action":"Upgrade october/october to 4.3.5 or later.","affected":[{"fixed":"4.3.5","introduced":"4.3.0"}],"component":"october/october","cve_ids":["CVE-2026-100909"],"ecosystem":"Packagist","epss":0.00298,"exploited":false,"fixed_versions":["4.3.5"],"ghsa_id":"GHSA-2xmm-m4wv-3fjh","id":"tcs_01M5KESDA5GSEBFNYMTH38HT0Z","modified_at":"2026-09-29T03:56:12.095308285Z","published_at":"2026-09-14T17:15:44Z","references":["https://osv.dev/vulnerability/GHSA-2xmm-m4wv-3fjh","https://github.com/octobercms/october/security/advisories/GHSA-2xmm-m4wv-3fjh","https://github.com/octobercms/october"],"severity":{"label":"low","score":3.9},"sources":[{"source":"osv","source_id":"GHSA-2xmm-m4wv-3fjh","url":"https://osv.dev/vulnerability/GHSA-2xmm-m4wv-3fjh"}],"summary":"October CMS: Incomplete Scheme Validation in Image Resizer"}