Live › vulnerability › CVE-2026-113388
Go to dashboardOpen Source Social Network (OSSN) up to 9.11 and 10.1 has a code injection flaw in the Cache Settings handler at actions/administrator/cache/dynamic.php. A remote attacker who can reach that input can get code run on the server, and a public exploit has been released.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
OSSN installations at or below 9.11 or 10.1 are exposed, and the flaw sits in the administrator Cache Settings page. The vendor states that site administrators are fully trusted, so exposure depends on whether an unprivileged or remote user can reach that input. Sites on an unaffected or patched OSSN version can skip this.
No product ranges from the sources yet.
9.11 and 10.1; versions at or below these are listed as affected.40945057cb451f0f35153110bc7e889c094400e1.40945057cb451f0f35153110bc7e889c094400e1 to OSSN, as the sources recommend.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 40945057cb451f0f35153110bc7e889c094400e1. Applying a patch is the recommended action to fix this issue. The vendor explains: "While we have implemented this patch as a defense-in-depth measure, we emphasize that in Open Source Social Network (OSSN), site administrators are fully trusted users who are intentionally granted broad system authority by design including the native ability to upload custom components/themes containing arbitrary PHP code."
This page as .md · .json · in your agent: get_signal("CVE-2026-113388")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.