{"id":"CVE-2026-113388","kind":"vulnerability","aliases":["CVE-2026-113388"],"related":[],"title":"OSSN: admin cache settings let remote code injection through PHP","description":"A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 40945057cb451f0f35153110bc7e889c094400e1. Applying a patch is the recommended action to fix this issue. The vendor explains: \"While we have implemented this patch as a defense-in-depth measure, we emphasize that in Open Source Social Network (OSSN), site administrators are fully trusted users who are intentionally granted broad system authority by design including the native ability to upload custom components/themes containing arbitrary PHP code.\"","summary":"Open Source Social Network (OSSN) up to 9.11 and 10.1 has a code injection flaw in the Cache Settings handler at actions/administrator/cache/dynamic.php. A remote attacker who can reach that input can get code run on the server, and a public exploit has been released.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ossn","other","php","self-hosted"],"not_affected_if":["patched-version"],"how_to_check":"- Check the installed OSSN version against `9.11` and `10.1`; versions at or below these are listed as affected.\n- Look at actions/administrator/cache/dynamic.php for the patched commit `40945057cb451f0f35153110bc7e889c094400e1`.\n- Confirm whether the Cache Settings admin page is reachable from the internet.","fix":"- Apply the patch `40945057cb451f0f35153110bc7e889c094400e1` to OSSN, as the sources recommend.\n- Restrict access to the administrator area until the patch is applied.","status":"open","published_at":"2026-10-20T12:17:29+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:10:20+00:00","updated_at":"2026-10-25T04:10:20+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:10:20Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the patch `40945057cb451f0f35153110bc7e889c094400e1` to OSSN, as the sources recommend.\n- Restrict access to the administrator area until the patch is applied.","reach":"internet","title":"OSSN: admin cache settings let remote code injection through PHP","impact":"high","summary":"Open Source Social Network (OSSN) up to 9.11 and 10.1 has a code injection flaw in the Cache Settings handler at actions/administrator/cache/dynamic.php. A remote attacker who can reach that input can get code run on the server, and a public exploit has been released.","category":"other","nicknames":[],"who_cares":["ossn","php","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code on the server via cache settings","analyst_note":"Confirm whether the Cache Settings endpoint requires admin login, using https://nvd.nist.gov/vuln/detail/CVE-2026-113388 and the OSSN release notes.","how_to_check":"- Check the installed OSSN version against `9.11` and `10.1`; versions at or below these are listed as affected.\n- Look at actions/administrator/cache/dynamic.php for the patched commit `40945057cb451f0f35153110bc7e889c094400e1`.\n- Confirm whether the Cache Settings admin page is reachable from the internet.","needs_analyst":true,"not_affected_if":["patched-version"],"who_is_affected":"OSSN installations at or below 9.11 or 10.1 are exposed, and the flaw sits in the administrator Cache Settings page. The vendor states that site administrators are fully trusted, so exposure depends on whether an unprivileged or remote user can reach that input. Sites on an unaffected or patched OSSN version can skip this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001209,"input_tokens":3488,"output_tokens":1721,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113388':13A,16A '-2026':12A,15A '/10.1':80C '10.1':32B '40945057cb451f0f35153110bc7e889c094400e1':130C '9.11':30B,79C 'abil':185C 'action':137C 'actions/administrator/cache/dynamic.php':44B,89C 'admin':2A 'administr':168C 'affect':82C 'appli':131C 'arbitrari':191C 'argument':100C 'attack':47B,107C,125C 'author':179C 'broad':177C 'cach':3A,40B,93C 'code':7A,35B,55B,104C,193C 'compon':92C 'components/themes':189C 'contain':190C 'custom':188C 'cve':11A,14A 'defens':154C 'defense-in-depth':153C 'depth':156C 'design':181C 'discov':72C 'emphas':159C 'explain':144C 'exploit':63B,113C 'file':88C 'fix':139C 'flaw':37B,69C 'fulli':170C 'function':84C 'get':54B 'grant':176C 'handler':42B 'host':22B 'host/port/username/password/type/status':101C 'implement':148C 'includ':182C 'initi':110C 'inject':8A,36B,105C 'input':52B,85C 'intent':175C 'issu':141C 'let':5A 'manipul':97C 'may':121C 'measur':157C 'name':129C 'nativ':184C 'network':26B,165C 'open':23B,162C 'opensourc':75C 'opensource-socialnetwork':74C 'ossn':1A,17B,27B,166C 'patch':127C,133C,150C 'perform':95C 'php':10A,19B,192C 'public':62B,119C 'reach':50B 'recommend':136C 'releas':66B,116C 'remot':6A,46B,111C 'result':102C 'run':56B 'secur':68C 'self':21B 'self-host':20B 'server':59B 'set':4A,41B,94C 'site':167C 'social':25B,164C 'socialnetwork':76C 'sourc':24B,163C 'system':178C 'trust':171C 'upload':187C 'use':123C 'user':172C 'vendor':143C","nicknames":[],"mitigations":[],"who_affected":"OSSN installations at or below 9.11 or 10.1 are exposed, and the flaw sits in the administrator Cache Settings page. The vendor states that site administrators are fully trusted, so exposure depends on whether an unprivileged or remote user can reach that input. Sites on an unaffected or patched OSSN version can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T12:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113388","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113388","severity":null,"published_at":"2026-10-20T12:17:29+00:00","modified_at":"2026-10-20T19:27:34+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}