Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-63146: Omnispace Agora Project allows remote code execution

CVE-2026-63146 · published 22 days ago

Summary

Versions of Omnispace Agora Project released before 26.10.0 let an attacker add their own PHP code to a configuration file during installation. This can happen because the installer does not properly filter input and can be tricked into running malicious database commands. Upgrade to version 26.10.0 or later, or reinstall with a clean setup, to block the issue.

What to do

Update omnispace agora project to version 26.10.0 or later.

Affected software

Vendor	Product	Affected versions
omnispace	agora project	< 26.10.0

Original advisory text

Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php

Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and DbInstall::dbControl(), combined with an SQL injection issue enabled by PDO::ATTR_EMULATE_PREPARES supporting stacked queries. Attackers can exploit the SQL injection to re-trigger the installer and inject arbitrary PHP code into config.inc.php, achieving unauthenticated remote code execution on the underlying system.

References

https://www.agora-project.net/ URL
https://www.vulncheck.com/advisories/omnispace-agora-project-php-code-injection-... Vendor Advisory
https://github.com/xech/agora-project Product
https://github.com/xech/agora-project/releases/tag/26.10 Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63146... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-63146 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.9 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-94Code Injection

Timeline

Published13 Oct 2026

Updated4 Nov 2026

First seen13 Oct 2026

Sources

CVE-2026-63146 · NVD

CVE-2026-63146 · MITRE

CVE-2026-63146 · OSV

Track software like this

Free during beta