OctoberCMS contains a vulnerability in its INI settings parser due to the use of PHP's parse_ini_string() function, which supports environment variable interpolation via ${} syntax. Attackers with Editor privileges can inject patterns like ${APP_KEY} or ${DB_PASSWORD} into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. When the page is reopened, these secrets are returned to the attacker, enabling exfiltration of credentials such as database passwords, AWS keys, and application keys. This vulnerability applies only when cms.safe_mode is enabled, as otherwise direct PHP injection is already possible. The issue is fixed in OctoberCMS versions 3.7.14 and 4.1.10.

Successful exploitation allows an attacker with Editor access to disclose sensitive environment variables, including credentials and keys, potentially leading to further attacks such as unauthorized database access or cookie forgery. The vulnerability does not allow integrity or availability impact directly but compromises confidentiality of critical secrets.

A fix is available in OctoberCMS versions 3.7.14 and 4.1.10; users should upgrade to these or later versions. For those unable to upgrade immediately, restrict Editor tool access to fully trusted administrators only and ensure that database and cloud service credentials are not accessible from the web server's network. Since this is a cloud-hosted service, the vendor manages remediation for the cloud environment; users should verify with the vendor advisory for cloud-specific patching status.