Vulnerability record · CVE-2020-26124 · published 2 October 2020
CVE-2020-26124: OpenMediaVault rpc.php sortfield PHP code injection
Openmediavault · Openmediavault
OpenMediaVault before 4.1.36 and 5.x before 5.5.12 fails to use json_encode_safe in config/databasebackend.inc, allowing PHP code injection through the sortfield POST parameter of rpc.php. An authenticated user can inject code that executes as root on the underlying operating system, making it a full host compromise rather than a web-only issue.
Description
openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks, via the sortfield POST parameter of rpc.php, because json_encode_safe is not used in config/databasebackend.inc. Successful exploitation allows arbitrary command execution on the underlying operating system as root.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityAuthenticated remote code execution as root with a public exploit and very high EPSS score, though it requires valid credentials.
What it is
OpenMediaVault before 4.1.36 and 5.x before 5.5.12 fails to use json_encode_safe in config/databasebackend.inc, allowing PHP code injection through the sortfield POST parameter of rpc.php. An authenticated user can inject code that executes as root on the underlying operating system, making it a full host compromise rather than a web-only issue.
Impact
An attacker with a valid account gains arbitrary command execution as root on the OpenMediaVault host, leading to complete control of the system and its stored data.
Attack surface
Reached over the network via HTTP POST to rpc.php with a crafted sortfield parameter; the CVSS vector (AV:N/PR:L/UI:N) indicates a low-privileged authenticated account is required and no user interaction is needed.
Exploitation
Not listed in CISA KEV, but EPSS is 0.67396 (99.27th percentile) and public exploit references exist, indicating high likelihood of exploitation.
What to do
- Upgrade OpenMediaVault to 4.1.36 or 5.5.12 (or later) to apply the json_encode_safe fix
- Restrict network access to the OpenMediaVault web interface to trusted management networks
- Audit and minimize accounts with access to rpc.php, removing unused or default credentials
- Monitor for unexpected root-level processes or file changes on OpenMediaVault hosts
Detection
- Inspect HTTP logs for POST requests to rpc.php containing sortfield parameters with PHP code or unusual characters
- Alert on new or unexpected root-owned processes and outbound connections from the OpenMediaVault host
- Review rpc.php access logs for requests from unusual source IPs or accounts
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://packetstormsecurity.com/files/160223/OpenMediaVault-rpc.php-Authenticated-PHP-Code-Injection.html | ExploitThird Party AdvisoryVDB Entry |
| https://github.com/openmediavault/openmediavault/commit/ebb51bbf5a39f4955eab0073bf87f2a31926d85d | PatchThird Party Advisory |
| https://www.openmediavault.org/?p=2797 | Vendor Advisory |
| http://packetstormsecurity.com/files/160223/OpenMediaVault-rpc.php-Authenticated-PHP-Code-Injection.html | ExploitThird Party AdvisoryVDB Entry |
| https://github.com/openmediavault/openmediavault/commit/ebb51bbf5a39f4955eab0073bf87f2a31926d85d | PatchThird Party Advisory |
| https://www.openmediavault.org/?p=2797 | Vendor Advisory |
Track CVE-2020-26124 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-26124), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
