CVE-2026-105226: Code Injection in osCommerce osCommerce2

This vulnerability in osCommerce osCommerce2 up to versions 2.3.4.0 and 2.3.4.1 involves the include function in admin/newsletters.php. By manipulating the module argument, an attacker can perform code injection remotely. The issue was reported early to the project but remains unaddressed. The CVSS 4.0 base score is 5.1, indicating medium severity with network attack vector, low complexity, no user interaction, and partial impacts on confidentiality, integrity, and availability.

Successful exploitation allows remote code injection, potentially enabling attackers to execute arbitrary code on the affected system. This can compromise system integrity and confidentiality to a limited extent. The vulnerability does not require user interaction and can be exploited remotely, increasing risk. However, the partial impact ratings and medium CVSS score suggest limited but significant potential damage.

No official patch or remediation has been released by the vendor as of the current information. Users should monitor the vendor's advisory channels for updates. Until a fix is available, consider restricting access to the affected admin/newsletters.php component and applying web application firewall rules to detect and block suspicious input targeting the module argument.