{"action":"Upgrade october/rain to 3.7.14 or later.","affected":[{"fixed":"4.1.10","introduced":"4.0.0"},{"fixed":"3.7.14","introduced":"0"}],"component":"october/rain","cve_ids":["CVE-2026-25125"],"ecosystem":"Packagist","epss":0.00326,"exploited":false,"fixed_versions":["4.1.10","3.7.14"],"ghsa_id":"GHSA-g6v3-wv4j-x9hg","id":"tcs_01M5KF2DDDAP0N98RXRG9ETV78","modified_at":"2026-05-08T20:46:20.988248Z","published_at":"2026-04-14T22:29:41Z","references":["https://osv.dev/vulnerability/GHSA-g6v3-wv4j-x9hg","https://github.com/octobercms/october/security/advisories/GHSA-g6v3-wv4j-x9hg","https://nvd.nist.gov/vuln/detail/CVE-2026-25125","https://github.com/octobercms/october"],"severity":{"label":"medium","score":4.9},"sources":[{"source":"osv","source_id":"GHSA-g6v3-wv4j-x9hg","url":"https://osv.dev/vulnerability/GHSA-g6v3-wv4j-x9hg"}],"summary":"October Rain has Environment Variable Exfiltration via INI Parser Interpolation"}