Omnispace Agora Project: Code injection in config.inc.php leads to remote code execution
Summary
Omnispace Agora Project before 26.10.0 contains a code injection flaw in its installer. Unescaped values are written into config.inc.php, and an SQL injection enabled by PDO emulated prepares with stacked queries lets an attacker re-trigger the installer. An unauthenticated attacker can use this to inject arbitrary PHP code and gain code execution on the underlying server. Risk is critical for instances reachable from the internet with an accessible installer path.
Affected
- Omnispace Agora Project versions before 26.10.0
Fixed in
- 26.10.0 or later; the latest 26.10.x release is recommended
Workaround
- No vendor workaround; a fixed release exists.
- Interim measure: restrict access to the installer path at the web server and remove or lock the installer after setup.
- Interim measure: limit the web server's write permissions to config.inc.php.
Exploitation
- CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
- No evidence of active exploitation or public exploit code found at the time of research.
Our recommendation
- Upgrade all Agora Project instances to 26.10.0 or later, preferably the latest 26.10.x.
- Check whether the installer is reachable from the internet and restrict or remove it.
- Review config.inc.php for unexpected PHP code and check web logs for unexpected installer activity.
- If compromise is suspected, rotate database credentials and other secrets used by the application.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory: Omnispace Agora Project PHP code injection via config.inc.php www.vulncheck.com
- Agora Project GitHub release 26.10 github.com
- Ionix threat center: CVE-2026-63146 www.ionix.io
- OSV: CVE-2026-63146 osv.dev
- Vulners: CVE-2026-63146 vulners.com
- CVE record (CNA VulnCheck, cvelistV5) raw.githubusercontent.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:13.
Original description (NVD)
Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and DbInstall::dbControl(), combined with an SQL injection issue enabled by PDO::ATTR_EMULATE_PREPARES supporting stacked queries. Attackers can exploit the SQL injection to re-trigger the installer and inject arbitrary PHP code into config.inc.php, achieving unauthenticated remote code execution on the underlying system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.