Description
Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and DbInstall::dbControl(), combined with an SQL injection issue enabled by PDO::ATTR_EMULATE_PREPARES supporting stacked queries. Attackers can exploit the SQL injection to re-trigger the installer and inject arbitrary PHP code into config.inc.php, achieving unauthenticated remote code execution on the underlying system.
Published: 2026-10-13
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

The vulnerability allows an attacker to inject arbitrary PHP code into the configuration file during the Agora Project installation process. Unescaped values from user input are written into config.inc.php, and an SQL injection via PDO with emulate prepares enables the attacker to re‑trigger the installer. This is a code injection weakness (CWE-94) that can be exploited without authentication, leading to unauthenticated remote code execution on the underlying system.

Affected Systems

Omnispace Agora Project versions prior to 26.10.0 are affected. The flaw resides in the File::updateConfigFile() and DbInstall::dbControl() components during setup.

Risk and Exploitability

The CVSS score of 9.3 indicates critical severity. EPSS information is unavailable, but the weakness is a classic code injection (CWE-94) that can be exploited without authentication. The attack vector is likely web‑based, requiring the installer to be reachable and configuration files to be writable. The vulnerability is not listed in CISA KEV at this time.

Generated by OpenCVE AI on October 14, 2026 at 00:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Agora Project 26.10.0 or later
  • Disable PDO::ATTR_EMULATE_PREPARES to prevent stacked queries
  • Restrict access to the installation interface and ensure only trusted users can modify configuration files

Generated by OpenCVE AI on October 14, 2026 at 00:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Agora-project
Agora-project agora-project
CPEs cpe:2.3:a:agora-project:agora-project:*:*:*:*:*:*:*:*
Vendors & Products Agora-project
Agora-project agora-project

Mon, 19 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Omnispace
Omnispace agora Project
Vendors & Products Omnispace
Omnispace agora Project

Sat, 17 Oct 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
Description Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and DbInstall::dbControl(), combined with an SQL injection issue enabled by PDO::ATTR_EMULATE_PREPARES supporting stacked queries. Attackers can exploit the SQL injection to re-trigger the installer and inject arbitrary PHP code into config.inc.php, achieving unauthenticated remote code execution on the underlying system.
Title Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Agora-project Agora-project
Omnispace Agora Project
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-27T10:14:12.914Z

Reserved: 2026-07-15T21:18:20.184Z

Link: CVE-2026-63146

cve-icon Vulnrichment

Updated: 2026-10-17T00:41:51.131Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T20:17:30.210

Modified: 2026-10-17T02:17:20.033

Link: CVE-2026-63146

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T13:09:56Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')