CVE-2026-105226: osCommerce osCommerce2 Newsletter Management newsletters.php include code injection
A security flaw has been discovered in osCommerce osCommerce2 up to 2.3.4.1. This vulnerability affects the function include of the file admin/newsletters.php of the component Newsletter Management. Performing a manipulation of the argument module results in code injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires high privileges, according to the provided CVSS vector. The vulnerable functionality is reachable remotely and does not require user interaction.
Which deployments are affected?
The issue affects osCommerce2 through version 2.3.4.1 in the Newsletter Management component, specifically admin/newsletters.php. The provided information does not identify any unaffected release or a vendor fix.
Is public exploit code available?
Yes. The exploit has been publicly released and may be used in attacks.
What can be done while no vendor response is available?
No specific workaround is provided. Restricting access to the administrative Newsletter Management functionality to trusted, authorized administrators can reduce exposure because exploitation requires high privileges.