CVE-2026-28517 Details

A command injection vulnerability has been identified in openDCIM versions through 23.04, commit 4467e9c4. The issue arises in the report_network_map.php file, where the application retrieves the 'dot' configuration parameter from the database and passes it directly to the exec() function without any validation or sanitization. This flaw allows attackers to execute arbitrary commands in the context of the web server process, particularly if they can modify the fac_Config.dot value.

Users can update to the latest version of openDCIM, where this vulnerability has been patched. Instructions for updating can be found in the openDCIM documentation.