openDCIM vulnerabilities
3 known CVE vulnerabilities in openDCIM, translated and rated.
- CVE-2026-28517Critical
openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sanitization.
- CVE-2026-28516High
openDCIM version 23.04 up to commit 4467e9c4 contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database.
- CVE-2026-28515High
openDCIM version 23.04 up to commit 4467e9c4 has a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless of assigned privileges.