---
id: "CVE-2026-113388"
kind: "vulnerability"
aliases: ["CVE-2026-113388"]
title: "OSSN: admin cache settings let remote code injection through PHP"
severity: "medium"
cvss: 5.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["ossn", "other", "php", "self-hosted"]
not_affected_if: ["patched-version"]
published_at: "2026-10-20T12:17:29+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:10:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113388", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# OSSN: admin cache settings let remote code injection through PHP

Open Source Social Network (OSSN) up to 9.11 and 10.1 has a code injection flaw in the Cache Settings handler at actions/administrator/cache/dynamic.php. A remote attacker who can reach that input can get code run on the server, and a public exploit has been released.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OSSN version against `9.11` and `10.1`; versions at or below these are listed as affected.
- Look at actions/administrator/cache/dynamic.php for the patched commit `40945057cb451f0f35153110bc7e889c094400e1`.
- Confirm whether the Cache Settings admin page is reachable from the internet.

## Fix

- Apply the patch `40945057cb451f0f35153110bc7e889c094400e1` to OSSN, as the sources recommend.
- Restrict access to the administrator area until the patch is applied.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113388

## From the sources

A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 40945057cb451f0f35153110bc7e889c094400e1. Applying a patch is the recommended action to fix this issue. The vendor explains: "While we have implemented this patch as a defense-in-depth measure, we emphasize that in Open Source Social Network (OSSN), site administrators are fully trusted users who are intentionally granted broad system authority by design including the native ability to upload custom components/themes containing arbitrary PHP code."

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_