RCE in Opensource-Socialnetwork
CVE-2026-113388
A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 40945057cb451f0f35153110bc7e889c094400e1. Applying a patch is the recommended action to fix this issue. The vendor explains: "While we have implemented this patch as a defense-in-depth measure, we emphasize that in Open Source Social Network (OSSN), site administrators are fully trusted users who are intentionally granted broad system authority by design including the native ability to upload custom components/themes containing arbitrary PHP code."
Published .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Opensource-Socialnetwork — versions 10.0, 10.1, 9.0
Weakness classification (CWE)
References
- VDB-422662 | opensource-socialnetwork Cache Settings dynamic.php input code injection (technical-description, vdb-entry)
- VDB-422662 | CTI Indicators (IOB, IOC, TTP, IOA) (signature, permissions-required)
- CVE-2026-113388 | CVE Analysis and Report (third-party-advisory)
- Submit #1009749 | opensource-socialnetwork Open Source Social Network (OSSN) v9.1.0.0 (master branch, commit 9983ea4) CWE-94 Remote Code Execution (RCE) (third-party-advisory)
- gist.github.com/qianqiusujiu/c0452f09e91de23f002a384038325104 (exploit)
- github.com/opensource-socialnetwork/opensource-socialnetwork/commit/40945057cb4… (patch)
- github.com/opensource-socialnetwork/opensource-socialnetwork/ (product)
Frequently asked questions
- What is CVE-2026-113388?
- CVE-2026-113388 is a medium-severity vulnerability in Opensource-Socialnetwork, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 4.3/10. Published 2026-10-20.
- How severe is CVE-2026-113388?
- Medium severity. CVSS v3 base score is 4.3 out of 10.