CVE-2026-28516

9.3 criticalEPSS 1.1%

openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 64% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-02-27
Modified: 2026-07-14
Record from: the NVD, synced 2026-10-19

Affected

opendcim:opendcim

References

https://chocapikk.com/posts/2026/opendcim-sqli-to-rce/
https://github.com/Chocapikk/opendcim-exploit
https://github.com/opendcim/openDCIM/blob/4467e9c4/config.inc.php#L75-L90
https://github.com/opendcim/openDCIM/blob/4467e9c4/install.php#L420-L434
https://github.com/opendcim/openDCIM/pull/1664

Check your stack JSON