What’s Vulnerable › Vulnerabilities

CVE-2020-26124

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 64.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-10-02 · updated 2026-06-17
• Weakness: CWE-94

Description

openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks, via the sortfield POST parameter of rpc.php, because json_encode_safe is not used in config/databasebackend.inc. Successful exploitation allows arbitrary command execution on the underlying operating system as root.

Affected products

• Openmediavault: before 4.1.36; from 5.0.0 before 5.5.12 — fixed in 4.1.36, 5.5.12

How to fix

Upgrade to a fixed version: Openmediavault 4.1.36, 5.5.12. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/160223/OpenMediaVault-rpc.php-Authenticated-PHP-Code-Injection.html
• https://github.com/openmediavault/openmediavault/commit/ebb51bbf5a39f4955eab0073bf87f2a31926d85d
• https://www.openmediavault.org/?p=2797
• http://packetstormsecurity.com/files/160223/OpenMediaVault-rpc.php-Authenticated-PHP-Code-Injection.html
• https://github.com/openmediavault/openmediavault/commit/ebb51bbf5a39f4955eab0073bf87f2a31926d85d
• https://www.openmediavault.org/?p=2797

Get alerted when CVE-2020-26124 or the next vulnerability affects your stack