CVE-2026-113388: Code Injection in opensource-socialnetwork

This vulnerability in opensource-socialnetwork up to versions 10.1 allows remote attackers to perform code injection via manipulation of the host, port, username, password, type, or status arguments in the actions/administrator/cache/dynamic.php file's input function. The issue affects the Cache Settings component and can be exploited remotely. The vendor has released a patch identified by commit 40945057cb451f0f35153110bc7e889c094400e1. The vendor also clarifies that site administrators inherently have broad privileges, including the ability to upload arbitrary PHP code, which is a design aspect of the platform.

Successful exploitation allows remote code injection, potentially enabling attackers to execute arbitrary code within the context of the application. However, the impact is somewhat mitigated by the fact that site administrators are trusted users with broad system authority by design. The CVSS 4.0 score is 4.8 (medium severity), reflecting limited impact due to required privileges and user interaction.

Apply the official patch identified by commit 40945057cb451f0f35153110bc7e889c094400e1 to remediate this vulnerability. Since the vendor has released this patch as a defense-in-depth measure, applying it is recommended. No additional mitigations are specified by the vendor. Note that the platform design assumes trusted site administrators with broad privileges.