CVE-2026-63162
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can set tmpFolderName to a traversal sequence targeting the web root to write attacker-controlled files and achieve remote code execution.
Risk Assessment
Potential remote code execution by writing malicious files into the web root. This can lead to full compromise of the application server.
Recommendation
Upgrade Omnispace Agora to version 26.10.0 or later. Anchor and validate the tmpFolderName value to prevent traversal outside the temporary directory.
Other vulnerabilities in Omnispace Agora Project
See all- CVE-2025-67079Critical
Omnispace Agora Project before 25.10 contains a file upload vulnerability allowing attackers to execute code through the MSL engine of the Imagick library via crafted PDF file to the file upload and thumbnail functions.
- CVE-2026-63171Medium
Stored XSS vulnerability in Omnispace Agora Project before 26.10.0 allows authenticated attackers to inject malicious script by submitting a crafted forum category description containing a double-quote character that breaks out of an HTML input value attribute.
- CVE-2026-63169Medium
Stored XSS vulnerability in Omnispace Agora Project before 26.10.0 allows authenticated users to post messages containing attacker-controlled iframes through the messenger's HTMLPurifier SafeIframe branch, enabling zero-click drive-by downloads and framed JavaScript execution in recipients' browsers.
- CVE-2026-63168Medium
Stored XSS vulnerability in Omnispace Agora Project before 26.10.0 allows authenticated attackers to persist unneutralized markup by submitting malicious values as two-dimensional POST arrays through the LDAP/person import flow, bypassing the paramsFilter() request parameter filter which failed to recurse into nested arrays.
- CVE-2026-63157Medium
Stored XSS vulnerability in Omnispace Agora Project before 26.10.0 allows authenticated users to inject malicious scripts by submitting an unsanitized link address (adress) field that is echoed into an onclick event-handler attribute without neutralizing quotes.
- CVE-2026-63156Medium
Reflected XSS vulnerability in Omnispace Agora Project before 26.10.0 allows unauthenticated attackers to inject malicious HTML attributes by manipulating the visioUrl parameter, which was not routed through the URL-sanitizing branch of the parameter filter and was urldecoded after filtering.
- CVE-2026-63174High
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. The missing readRight() check in the import flow's join INSERT breaks tenant isolation and allows manipulation of user-space assignments across unauthorized spaces.
- CVE-2026-63172High
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. The missing editRight() enforcement in actionVueEditUser allows creation of unauthorized user accounts, leading to privilege escalation.
- CVE-2026-63165High
Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php. Attackers can use error-based techniques such as extractvalue payloads to extract database information, including version data.
- CVE-2026-63163High
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5(filename) token instead of passing a proper authorization check. Attackers can guess or determine file names to generate the corresponding md5 token and retrieve protected files without authorization.
Original NVD description (English source)
Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by setting tmpFolderName to a traversal sequence targeting the web root, to write attacker-controlled files and achieve remote code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS