# CVE-2026-36670: OpenSIPS Control Panel SQL injection in alias_management module

Source: https://junglewise.ai/threats/cve-2026-36670-opensips-control-panel-sql-injection-in-alias-management-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-36670 · Severity: info · CVSS 8.8 · Published 2026-06-15

OpenSIPS Control Panel is a web-based interface used to manage OpenSIPS, a popular open-source tool for handling internet-based phone calls and messaging. A security flaw in the alias management section allows a logged-in user to run unauthorized database commands. This could lead to the theft of sensitive configuration data, user information, or the disruption of communication services.

Vendors: [OpenSIPS](https://junglewise.ai/threats/vendors/opensips).

## Quick answers

**Is CVE-2026-36670 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-36670 being exploited in the wild.

**How severe is CVE-2026-36670?** Informational severity, with a CVSS score of 8.8, published 15 June 2026.

**Which products and versions are affected?** OpenSIPS Control Panel < 9.3.3.

**Is there a fix for CVE-2026-36670?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-36670 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-36670?** Check whether you run OpenSIPS Control Panel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A time-based blind SQL injection vulnerability exists in the alias_management module of OpenSIPS Control Panel (opensips-cp) prior to version 9.3.3. The flaw is located in alias_management.php and stems from the unsafe concatenation of the 'table' GET parameter into an SQL query. While the application uses PDO with silent error reporting, which may cause the web template to crash after execution, the SQL command is still processed by the backend database. An authenticated attacker can leverage time-based techniques to exfiltrate data from the database. Users should upgrade to version 9.3.3 or later to remediate this issue.

## Affected products

- OpenSIPS OpenSIPS Control Panel < 9.3.3

## Timeline

- 2026-06-09: disclosed: Initial disclosure date reported in advisory
- 2026-06-15: advisory: CVE published to NVD dataset

## References

- [https://github.com/Gabriel-Lacorte/CVE-2026-36670/blob/main/ADVISORY.md](https://github.com/Gabriel-Lacorte/CVE-2026-36670/blob/main/ADVISORY.md)