October Rain CMS has a server-side information disclosure vulnerability in its INI settings parser due to environment variable interpolation via the `${}` syntax in `parse_ini_string()`. Attackers with Editor access can inject environment variable references like `${APP_KEY}` or `${DB_PASSWORD}` into CMS page settings, causing sensitive environment variables to be exposed when the page is reopened. This vulnerability requires authenticated backend Editor permissions and is relevant only when `cms.safe_mode` is enabled. The issue has been patched in versions 3.7.14 and 4.1.10.