OctoberCMS contains a vulnerability in its INI settings parser due to PHP's parse_ini_string() function supporting environment variable interpolation via ${} syntax. Attackers with Editor privileges can inject patterns like ${APP_KEY} or ${DB_PASSWORD} into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. When the page is reopened, these secrets are disclosed to the attacker. This issue affects versions prior to 3.7.14 and 4.1.10 and is only exploitable when cms.safe_mode is enabled. The vulnerability allows exposure of sensitive information such as database passwords and AWS keys, potentially enabling further attacks. The issue is fixed in versions 3.7.14 and 4.1.10. If immediate upgrade is not possible, restricting Editor access and securing credentials on the network are recommended mitigations.

Successful exploitation allows an attacker with Editor access to exfiltrate sensitive environment variables including database passwords, AWS keys, and application keys. This exposure can lead to further attacks such as unauthorized database access or cookie forgery. The vulnerability does not affect availability or integrity directly but compromises confidentiality of critical secrets.

A fix is available in OctoberCMS versions 3.7.14 and 4.1.10. Users should upgrade to these versions to fully remediate the vulnerability. If immediate upgrade is not possible, restrict Editor tool access strictly to fully trusted administrators and ensure that database and cloud service credentials are not accessible from the web server's network. Since this is a cloud service, the vendor manages remediation for hosted environments; users should verify with the vendor advisory for cloud-specific patch status.