A critical flaw in Omnispace Agora Project before version 26.10.0 chains SQL injection with installer code injection, which lets an unauthenticated attacker run arbitrary code on the underlying system.
What Is It
CVE-2026-63146 is a code injection vulnerability (CWE-94) in Omnispace Agora Project. During installation, File::updateConfigFile() and DbInstall::dbControl() write unescaped, attacker-controlled values into the config.inc.php configuration file.
The project also has a separate SQL injection issue. It is exploitable because PDO::ATTR_EMULATE_PREPARES allows stacked queries. An attacker can use that SQL injection to re-trigger the installer. They can then inject arbitrary PHP code into config.inc.php, which gives them unauthenticated remote code execution.
VulnCheck reported the vulnerability, and NVD published it on October 13, 2026. The NVD record's status is currently "Received."
Why It Matters
VulnCheck scores this vulnerability 9.8 (CRITICAL) under CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and 9.3 (CRITICAL) under CVSS 4.0. Both scores mean:
- An attacker can exploit it over the network.
- The attack is low complexity.
- No privileges are needed.
- No user interaction is needed.
A successful attack has a high impact on confidentiality, integrity and availability. Because the PHP code is written into a configuration file, the attacker's code runs on the host itself.
The supplied CISA KEV data contains no entry for CVE-2026-63146. Active exploitation is not confirmed by KEV at this time, and the supplied sources say nothing about known in-the-wild exploitation.
What's Vulnerable
- Vendor: Omnispace
- Product: Agora Project
- Affected versions: all versions before 26.10.0
- Repository: github.com/xech/agora-project (
pkg:github/xech/agora-project)
Versions outside this range are listed as unaffected. NVD has not yet listed any CPE entries.
Patch Status
The fix is in Agora Project 26.10.0, according to the affected-version data. The project's GitHub releases page has a 26.10 release tag. Administrators should upgrade affected installations to 26.10.0 or later. No CISA KEV required action or due date applies, because the supplied data has no KEV entry.