CVE-2026-113388
Received Received - Intake

Code Injection in OpenSource-SocialNetwork

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulDB

Description
A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 40945057cb451f0f35153110bc7e889c094400e1. Applying a patch is the recommended action to fix this issue. The vendor explains: "While we have implemented this patch as a defense-in-depth measure, we emphasize that in Open Source Social Network (OSSN), site administrators are fully trusted users who are intentionally granted broad system authority by design including the native ability to upload custom components/themes containing arbitrary PHP code."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113388
EUVD
EUVD-2026-104967

Affected Vendors & Products

Showing 14 associated CPEs
Vendor Product Version / Range
n/a opensource-socialnetwork 9.0
n/a opensource-socialnetwork 9.1
n/a opensource-socialnetwork 9.2
n/a opensource-socialnetwork 9.3
n/a opensource-socialnetwork 9.4
n/a opensource-socialnetwork 9.5
n/a opensource-socialnetwork 9.6
n/a opensource-socialnetwork 9.7
n/a opensource-socialnetwork 9.8
n/a opensource-socialnetwork 9.9
n/a opensource-socialnetwork 9.10
n/a opensource-socialnetwork 9.11
n/a opensource-socialnetwork 10.0
n/a opensource-socialnetwork 10.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-113388 is a PHP code injection vulnerability in Open Source Social Network (OSSN) versions up to 9.11/10.1. It exists in the file actions/administrator/cache/dynamic.php where user-controlled inputs like host, port, username, password, type, and status are improperly sanitized and directly interpolated into a PHP configuration file. This allows attackers to inject malicious PHP code that executes on every page request, enabling remote code execution.

Detection Guidance

Check OSSN versions up to 9.11/10.1 for the vulnerable file actions/administrator/cache/dynamic.php. Look for unexpected PHP code in ossn.config.dcache.php or recent changes to cache settings via admin panel.

Impact Analysis

An attacker with admin access can exploit this to execute arbitrary OS commands on the server, compromising confidentiality, integrity, and availability. The backdoor persists until settings are manually rewritten, and even unauthenticated users may be affected. Full system compromise is possible from a single admin session compromise.

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or deletion, violating GDPR's data protection principles and HIPAA's security requirements. Non-compliance risks include fines, legal penalties, and reputational damage due to potential breaches of sensitive user data.

Mitigation Strategies

Apply the patch 40945057cb451f0f35153110bc7e889c094400e1 immediately. Review and remove any suspicious PHP code in ossn.config.dcache.php. Restrict admin access and monitor for unauthorized changes to cache settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113388. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart