CVE-2026-63157

Omnispace Agora Project before 25.10 contains a file upload vulnerability allowing attackers to execute code through the MSL engine of the Imagick library via crafted PDF file to the file upload and thumbnail functions.

Stored XSS vulnerability in Omnispace Agora Project before 26.10.0 allows authenticated attackers to inject malicious script by submitting a crafted forum category description containing a double-quote character that breaks out of an HTML input value attribute.

Stored XSS vulnerability in Omnispace Agora Project before 26.10.0 allows authenticated users to post messages containing attacker-controlled iframes through the messenger's HTMLPurifier SafeIframe branch, enabling zero-click drive-by downloads and framed JavaScript execution in recipients' browsers.

Stored XSS vulnerability in Omnispace Agora Project before 26.10.0 allows authenticated attackers to persist unneutralized markup by submitting malicious values as two-dimensional POST arrays through the LDAP/person import flow, bypassing the paramsFilter() request parameter filter which failed to recurse into nested arrays.

Reflected XSS vulnerability in Omnispace Agora Project before 26.10.0 allows unauthenticated attackers to inject malicious HTML attributes by manipulating the visioUrl parameter, which was not routed through the URL-sanitizing branch of the parameter filter and was urldecoded after filtering.

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. The missing readRight() check in the import flow's join INSERT breaks tenant isolation and allows manipulation of user-space assignments across unauthorized spaces.

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. The missing editRight() enforcement in actionVueEditUser allows creation of unauthorized user accounts, leading to privilege escalation.

Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php. Attackers can use error-based techniques such as extractvalue payloads to extract database information, including version data.

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5(filename) token instead of passing a proper authorization check. Attackers can guess or determine file names to generate the corresponding md5 token and retrieve protected files without authorization.

Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can set tmpFolderName to a traversal sequence targeting the web root to write attacker-controlled files and achieve remote code execution.