A flaw in the diem project’s dmCodeEditor component allows a remote attacker to manipulate the dmOs::join function in actions.class.php so that a requested path can traverse outside the intended directory. When the attacker supplies crafted input, the file path resolution can be subverted, leading to disclosure or modification of sensitive files on the server. The weakness is a classic path traversal flaw identified as CWE‑22.

The vulnerability affects instances of diem project’s diem software up to version 5.1.3. It is present in the dmFrontPlugin/modules/dmCodeEditor/actions/actions.class.php file and impacts all deployments that include the dmCodeEditor module in that release range.

The CVSS score of 5.1 indicates moderate impact. No EPSS value is available, and the vulnerability is not listed in CISA’s KEV catalog. The flaw can be exploited remotely—an attacker with internet access can construct a request directing the application to resolve an over‑oriented path. Exploit code has been published and is potentially usable by adversaries who have discovered the issue. The exploit does not appear to require local privileges or administrative access to the underlying operating system, but it can still allow unauthorized file access on the web server’s filesystem.