PT-2026-22427 · Opendcim · Opendcim

Valentin Lobstein

·

Published

2026-02-27

·

Updated

2026-05-14

·

CVE-2026-28517

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions openDCIM versions 23.04 through commit 4467e9c4
Description The application retrieves the dot configuration parameter from the database and passes it directly to the exec() function without validation or sanitation. If an attacker can modify the fac Config.dot value, arbitrary commands may be executed in the context of the web server process. The vulnerable file is report network map.php.
Recommendations Versions prior to commit 4467e9c4 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-28517

Affected Products

Opendcim