Which versions of openDCIM are affected by CVE-2026-28517?

openDCIM 23.04 contains a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary commands on the web server, exploitable through database parameter…. A patch is available.

Is there a public PoC exploit available for CVE-2026-28517?

Yes, a public proof-of-concept exploit is available for CVE-2026-28517. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2026-28517?

Within 24 hours: Identify all openDCIM 23.04 instances in your environment and isolate them from untrusted networks or disable external access. Within 7 days: Apply the vendor-released patch to upgrade openDCIM to version 23.05 or later. Within 30 days: Conduct forensic review of openDCIM server logs, database audit trails, and system command histories for indicators of exploitation or unauthorized access dating back to deployment.

openDCIM CVE-2026-28517

Q: What is the CVSS score of CVE-2026-28517?

CVE-2026-28517 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

CRITICAL

OS Command Injection (CWE-78)

2026-02-27 disclosure@vulncheck.com

PHP Command Injection Opendcim

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vulncheck) · only source for this CVE.

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 12, 2026 - 01:27 vuln.today

Analysis Updated

May 12, 2026 - 01:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 12, 2026 - 01:22 vuln.today

cvss_changed

CVSS changed

May 12, 2026 - 01:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 10, 2026 - 14:40 vuln.today

Public exploit code

Patch released

Mar 10, 2026 - 14:40 nvd

Patch available

CVE Published

Feb 27, 2026 - 23:16 nvd

CRITICAL 9.8

DescriptionCVE.org

openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sanitation. If an attacker can modify the fac_Config.dot value, arbitrary commands may be executed in the context of the web server process.

AnalysisAI

Remote code execution in openDCIM 23.04 allows unauthenticated attackers to execute arbitrary OS commands as the web server user by poisoning the 'dot' configuration parameter in the database, then triggering execution via report_network_map.php. Public exploit code exists with a documented SQL injection to command injection attack chain. EPSS score of 0.57% (68th percentile) suggests moderate but not widespread exploitation probability, though the publicly available weaponized exploit significantly elevates real-world risk for exposed instances.

Technical ContextAI

openDCIM is a PHP-based data center infrastructure management application. The vulnerability exists in report_network_map.php which generates network topology graphs using the Graphviz 'dot' command-line utility. The application retrieves the dot executable path from the fac_Config database table and passes it directly to PHP's exec() function without validation (lines 7, 467 in commit 4467e9c4). This represents a classic CWE-78 OS Command Injection where externally-influenced input reaches a command execution sink. The affected CPE is cpe:2.3:a:opendcim:opendcim:23.04, indicating the vulnerability is present in version 23.04 through the referenced commit. The fix (PR #1664) implements three controls: escapeshellarg() wrapping of all exec() parameters, is_executable() validation of the dot command path, and parameterized SQL queries to prevent the initial database poisoning vector.

RemediationAI

Apply the vendor-released patch available via GitHub Pull Request #1664 at https://github.com/opendcim/openDCIM/pull/1664 (specific commit 8f7ab2a710086a9c8c269560793e47c577ddda09 at https://github.com/opendcim/openDCIM/pull/1664/changes/8f7ab2a710086a9c8c269560793e47c577ddda09). The patch implements three security controls: escapeshellarg() sanitization of all exec() parameters in report_network_map.php, is_executable() validation of the dot command path before execution, and parameterized SQL queries in config.inc.php to prevent the database poisoning vector. If immediate patching is not feasible, implement these compensating controls with noted trade-offs: (1) Restrict access to report_network_map.php to authenticated administrators only via web server access controls-this breaks unauthenticated report access if that feature is in use. (2) Set the fac_Config.dot database value to an absolute path and make the fac_Config table read-only to the web application database user-this prevents runtime configuration changes through the web interface. (3) Deploy web application firewall rules to block SQL injection attempts targeting fac_Config table-this adds latency and requires tuning to avoid false positives. (4) Run the web server process in a restricted container or chroot environment with no access to sensitive system utilities-this limits post-exploitation impact but may break legitimate Graphviz functionality if not configured correctly.