CVE-2026-63146

Deferred Deferred - Pending Action

Remote Code Execution in Omnispace Agora Project

Publication date: 2026-10-13

Last updated on: 2026-10-17

Assigner: VulnCheck

Description

Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and DbInstall::dbControl(), combined with an SQL injection issue enabled by PDO::ATTR_EMULATE_PREPARES supporting stacked queries. Attackers can exploit the SQL injection to re-trigger the installer and inject arbitrary PHP code into config.inc.php, achieving unauthenticated remote code execution on the underlying system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-17

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-63146

EUVD

EUVD-2026-100528

Affected Vendors & Products

Vendor	Product	Version / Range
Omnispace	Agora	Project 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

CVE-2026-63146 is a PHP code injection vulnerability in Omnispace Agora Project versions before 26.10.0. It occurs during installation when unescaped attacker-controlled values are written into config.inc.php via File::updateConfigFile() and DbInstall::dbControl(). An SQL injection flaw enabled by PDO::ATTR_EMULATE_PREPARES allows stacked queries, letting attackers re-trigger the installer to inject arbitrary PHP code. This results in unauthenticated remote code execution on the system.

Detection Guidance

Check if Omnispace Agora Project version is below 26.10.0 by inspecting the config.inc.php file or running version checks. Look for unexpected PHP code in config.inc.php or unusual installer re-triggers. Monitor network traffic for signs of SQL injection attempts targeting PDO::ATTR_EMULATE_PREPARES.

Impact Analysis

If you use Omnispace Agora Project before version 26.10.0, attackers could exploit this to execute arbitrary code on your server without authentication. This could lead to full system compromise, data theft, or further network infiltration. The high CVSS score indicates severe potential impact.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties, reputational damage, and loss of compliance certifications if exploited.

Mitigation Strategies

Upgrade Omnispace Agora Project to version 26.10.0 or later immediately. Remove write permissions from config.inc.php and disable PDO::ATTR_EMULATE_PREPARES if possible. Review and sanitize all user inputs during installation to prevent code injection.

Hi! I’m here to help you understand CVE-2026-63146. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70