CVE-2026-63146

CRITICAL 9.8

Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and DbInstall::dbControl(), combined with an SQL injection issue enabled by PDO::ATTR_EMULATE_PREPARES supporting stacked queries. Attackers can exploit the SQL injection to re-trigger the installer and inject arbitrary PHP code into config.inc.php, achieving unauthenticated remote code execution on the underlying system.

CWE	CWE-94
Vendor	omnispace
Product	agora project
Published	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for omnispace agora project

Be the first to know when new critical vulnerabilities affecting omnispace agora project are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Omnispace / Agora Project

0 < 26.10.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/xech/agora-project/releases/tag/26.10 agora-project.net: https://www.agora-project.net/ vulncheck.com: https://www.vulncheck.com/advisories/omnispace-agora-project-php-code-injection-via-config-inc-php

Credits

Geoffrey Robert of akailabs