CVE-2026-28517 is a critical (CVSS 9.8) OS command injection in openDCIM version 23.04 through commit 4467e9c4. The report_network_map.php page passes the stored dot setting straight to exec(). A pull request exists upstream, but I could not confirm a released fix, so check the project.
What's affected
The record names openDCIM version 23.04, through commit 4467e9c4. The affected file is report_network_map.php.
The upstream pull request that addresses it (number 1664) showed as closed rather than merged when I read it, and the record gives no fixed version. Check the openDCIM repository for the current status before you decide you are patched.
How to check if you're exposed
Find where openDCIM is deployed and which commit or release it runs. If you installed from git:
git -C /var/www/dcim log -1 --format=%H
Compare the result with commit 4467e9c4. Then ask who can change the application's configuration table in the database, because the issue depends on the dot value stored there.
What to do now
- Inventory every openDCIM install and its commit or version.
- Restrict network access to the application to trusted admin networks only.
- Apply the upstream fix if you have confirmed it, or apply equivalent validation of the configured program path and escaping of arguments in the page.
- Audit database write access and the application account, so that only trusted administrators can alter configuration values.
- Check the web server user for unexpected processes or files if exposure was wide.
Why it matters
This is OS command injection, CWE-78. The page reads a configuration value from the database and hands it to a shell execution call without validation.
The record says an attacker needs to be able to modify that value for commands to run. That makes the real risk depend on other bugs or weak access that let someone write to the configuration. A researcher write-up listed in the record describes chaining it from SQL injection, so treat configuration data as a trust boundary and not as safe input just because it sits in your own database.
The record does not mark the CVE as exploited in the wild, though a public exploit repository is referenced.
Quick check
The fix pull request was closed. Am I unpatched?
Possibly. A closed pull request is not proof of a merged fix. Confirm in the repository whether a later commit or release contains the change before you consider the issue handled.
Sources
Last reviewed: 19 October 2026.
