CVE-2026-28517
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sanitization.
Risk Assessment
An attacker who can modify the fac_Config.dot value in the database may execute arbitrary system commands in the context of the web server process, leading to full server compromise.
Recommendation
Immediately update openDCIM to a version containing the fix after commit 4467e9c4 or apply a workaround by strictly validating and sanitizing the 'dot' parameter before passing it to exec().
Other vulnerabilities in openDCIM
See all- CVE-2026-28516High
openDCIM version 23.04 up to commit 4467e9c4 contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database.
- CVE-2026-28515High
openDCIM version 23.04 up to commit 4467e9c4 has a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless of assigned privileges.
Original NVD description (English source)
openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sanitization. If an attacker can modify the fac_Config.dot value, arbitrary commands may be executed in the context of the web server process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS