CVE-2026-113388: opensource-socialnetwork Cache Settings dynamic.php input code injection
A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 40945057cb451f0f35153110bc7e889c094400e1. Applying a patch is the recommended action to fix this issue. The vendor explains: "While we have implemented this patch as a defense-in-depth measure, we emphasize that in Open Source Social Network (OSSN), site administrators are fully trusted users who are intentionally granted broad system authority by design including the native ability to upload custom components/themes containing arbitrary PHP code."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
opensource-socialnetwork Cache Settingsto a version that resolves this vulnerability.Patch 40945057cb451f0f35153110bc7e889c094400e1
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires high privileges. The affected Cache Settings functionality is associated with site administrators, whom OSSN treats as fully trusted users with broad system authority.
What input is involved in the code injection?
The affected dynamic.php endpoint processes Cache Settings arguments including host, port, username, password, type, and status. Manipulation of these arguments can result in code injection.
Is exploitation practical for a remote attacker?
The issue can be initiated remotely, but the CVSS vector indicates high privileges and user interaction are required. Public exploit code has been released and may be used in attacks.
What is the recommended remediation?
Apply patch 40945057cb451f0f35153110bc7e889c094400e1. The vendor describes the change as defense in depth because OSSN administrators already have the designed ability to upload components or themes containing arbitrary PHP code.