Code Injection Vulnerability in Open Source Social Network by OSSN
CVE-2026-113388

4.8MEDIUM

Key Information:

Vendor

OSSN

Status
Opensource-socialnetwork
Vendor
CVE Published:
20 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-113388?

A security flaw exists in the Open Source Social Network (OSSN) that allows for code injection through the input manipulation of the Cache Settings component. Specifically, the vulnerability is found in the actions/administrator/cache/dynamic.php file and can be exploited remotely by altering the host/port/username/password/type/status parameters. This loophole highlights the inherent risks in OSSN's design where site administrators have significant system control. The responsible patch is available under commit 40945057cb451f0f35153110bc7e889c094400e1, and applying this patch is crucial for securing affected instances.

Affected Version(s)

opensource-socialnetwork 9.0

opensource-socialnetwork 9.1

opensource-socialnetwork 9.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-113388 - Proof of Concept

References

https://vuldb.com/vuln/422662
vdb-entrytechnical-description
https://vuldb.com/vuln/422662/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-113388
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

qianqiu (VulDB User)
VulDB CNA Team
.