{"cvss":0.0,"datePublished":"2026-05-14T00:00:00Z","dateUpdated":"2026-05-14T00:00:00Z","description":"openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sanitization. If an attacker can modify the fac_Config.dot value, arbitrary commands may be executed in the context of the web server process.","dueDate":"","id":"CVE-2026-28517","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"opendcim","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"opendcim opendcim Improper Neutralization of Special Elements used in an OS Command","vendor":"opendcim"}