Remote Code Execution in Omnispace Agora Project via CVE-2026-63146

Omnispace Agora Project versions before 26.10.0 contain a critical code injection vulnerability (CVE-2026-63146) that allows unauthenticated remote code execution (RCE). The vulnerability stems from improper sanitization during the application installation process within the File::updateConfigFile() and DbInstall::dbControl() functions. Attackers can leverage an underlying SQL injection vulnerability enabled by PDO::ATTR_EMULATE_PREPARES, which supports stacked queries. By executing stacked SQL queries, an attacker can trigger the re-installation workflow of the application and inject arbitrary PHP code directly into the config.inc.php configuration file. This vulnerability is particularly dangerous as it provides a pathway for an unauthenticated user to achieve full control over the application and the underlying server environment.

Impact

Successful exploitation results in full remote code execution, granting attackers the ability to run arbitrary system commands, exfiltrate sensitive data, or establish persistence on the host server. The vulnerability carries a CVSS v3.1 base score of 9.8, reflecting the ease of exploitation and the critical nature of the impact. Any server running an affected version of Agora Project is at risk of total compromise.

Recommendation

Prioritized actions for security and IT operations teams:

• Upgrade all instances of Omnispace Agora Project to version 26.10.0 or later immediately to patch CVE-2026-63146.
• Review the config.inc.php file on all accessible web servers for unauthorized PHP code or unexpected changes.
• Disable PDO::ATTR_EMULATE_PREPARES in database connection configurations if the application logic permits, to mitigate the feasibility of stacked query-based SQL injection.