Description
A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 40945057cb451f0f35153110bc7e889c094400e1. Applying a patch is the recommended action to fix this issue. The vendor explains: "While we have implemented this patch as a defense-in-depth measure, we emphasize that in Open Source Social Network (OSSN), site administrators are fully trusted users who are intentionally granted broad system authority by design including the native ability to upload custom components/themes containing arbitrary PHP code."
Published: 2026-10-20
Score: 4.8 Medium
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A security flaw discovered in opensource-socialnetwork up to versions 9.11 and 10.1 affects the Cache Settings component. Manipulating the host, port, username, password, type, and status parameters in actions/administrator/cache/dynamic.php allows untrusted input to be executed as PHP code, resulting in code injection that runs with application privileges.

Affected Systems

All installations of opensource-socialnetwork that include the Cache Settings component up to releases 9.11 and 10.1 are vulnerable. Administrators have built‑in broad authority, including the ability to upload custom components or themes that contain arbitrary PHP code, which compounds the risk.

Risk and Exploitability

The CVSS score for this issue is 4.8, indicating moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, an exploit has been publicly released and the attack can be initiated remotely against the administrator interface or via a trusted site administrator, enabling remote code execution on the server.

Generated by OpenCVE AI on October 20, 2026 at 15:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor patch commit 40945057cb451f0f35153110bc7e889c094400e1 to the Cache Settings component immediately.
  • Limit administrator privileges to a minimal set of trusted users and remove the ability to upload custom components or themes unless absolutely necessary.
  • Disable the dynamic.php feature if it is not required for site operation.

Generated by OpenCVE AI on October 20, 2026 at 15:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 40945057cb451f0f35153110bc7e889c094400e1. Applying a patch is the recommended action to fix this issue. The vendor explains: "While we have implemented this patch as a defense-in-depth measure, we emphasize that in Open Source Social Network (OSSN), site administrators are fully trusted users who are intentionally granted broad system authority by design including the native ability to upload custom components/themes containing arbitrary PHP code."
Title opensource-socialnetwork Cache Settings dynamic.php input code injection
First Time appeared Opensource-socialnetwork
Opensource-socialnetwork opensource-socialnetwork
Weaknesses CWE-74
CWE-94
CPEs cpe:2.3:a:opensource-socialnetwork:opensource-socialnetwork:*:*:*:*:*:*:*:*
Vendors & Products Opensource-socialnetwork
Opensource-socialnetwork opensource-socialnetwork
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Opensource-socialnetwork Opensource-socialnetwork
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-20T16:06:22.411Z

Reserved: 2026-10-20T05:29:08.714Z

Link: CVE-2026-113388

cve-icon Vulnrichment

Updated: 2026-10-20T15:22:25.705Z

cve-icon NVD

Status : Deferred

Published: 2026-10-20T12:17:29.237

Modified: 2026-10-20T19:27:34.430

Link: CVE-2026-113388

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T15:45:16Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')