OpenSource Social Network EUVD-2026-104967

Requires an authenticated OSSN site administrator account and access to the Cache Settings feature at actions/administrator/cache/dynamic.php; the attacker must submit crafted PHP in one of the host, port, username, password, type, or status arguments, which pre-patch is concatenated directly into the generated ossn.config.dcache.php file. Limiting factors that reduce real-world risk: (1) administrator-level authentication is mandatory (PR:H), and in OSSN administrators are trusted users who can already upload arbitrary PHP components/themes, so this grants no new capability; (2) the dynamic cache feature must be in use/configured; (3) it is effectively a self-authorized action rather than a cross-privilege escalation. No unauthenticated or lower-privilege path exists per the available data.

This is a high-CVSS-label-absent, genuinely LOW real-risk issue, and the signals are internally consistent. The CVSS 4.0 base score is 1.9, with a vector (AV:N/AC:L/AT:N/PR:H/UI:P) that requires High privileges - i.e. an authenticated site administrator. CWE-94 (code injection) via the Cache Settings host/port/username/password/type/status arguments written unescaped into ossn.config.dcache.php technically yields PHP code execution, but the vendor (OSSN) explicitly states administrators are fully trusted users who by design can already upload arbitrary PHP components/themes - so the flaw grants an admin no capability they do not already possess. Exploitation signal: publicly available exploit code exists (a GitHub gist is linked as an exploit reference); this is NOT confirmed active exploitation - the CVE is not in CISA KEV and no EPSS score was provided in the input. Do not conflate the public POC with in-the-wild use. The SSVC/decision view: exploitation is 'POC' (E:P in the 4.0 vector), technical impact is partial (VC:L/VI:L/VA:L as scored by the reporter, though code injection could arguably be higher), and it is not automatable given the admin prerequisite. Net: this is a defense-in-depth hardening fix, not an urgent priority. The main caveat to flag explicitly: the reporter scored impact as Low (VC:L/VI:L/VA:L) despite the bug being code injection/RCE-class - the limiting factor justifying 'Low' is the pre-existing admin trust model, not a limit on the code-execution primitive itself.

An authenticated OSSN site administrator (or an attacker who has already hijacked an admin session) opens the dynamic cache configuration and submits cache settings (e.g. the host or username field) containing crafted PHP, which is written unescaped into ossn.config.dcache.php and executed when the cache config is loaded. A public proof-of-concept exploit exists as a GitHub gist. Because CVSS requires PR:H, this is a privilege-already-held scenario rather than a path from unauthenticated outsider to code execution.