CVE-2026-63146

Summary

A code injection vulnerability in Omnispace Agora Project allows attackers to inject arbitrary PHP code into the configuration file during installation, leading to unauthenticated remote code execution. This critical flaw combines SQL injection with improper input escaping to enable persistent code injection.

Exploitability

The vulnerability is highly exploitable with no authentication required, as attackers can trigger the installer through SQL injection and inject malicious PHP code that gets executed on the server.

Blast radius

Exploitation could lead to complete system compromise with persistent backdoor access, as the injected code executes in the context of the web server with full filesystem access.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 26.10.0 or later to address this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.