An authenticated user can inject shell commands through unescaped folder paths in the storage module. By creating a directory name that contains shell metacharacters such as $(...), the attacker can trigger the move or copy operation and have the commands executed with the web‑server process privileges. This is a classic OS command injection weakness (CWE‑78) that can lead to remote code execution and full system compromise.

The vulnerability resides in Volmarg Personal Management System up to and including version 2.1.0. The product is distributed as open source under the name Volmarg Personal Management System. No patch version is specified in the advisory, so any deployment of 2.1.0 or earlier is affected.

The CVSS score is 8.6, indicating a high severity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers require an authenticated account to reach the exploit; the storage module is exposed through the web interface. Once authenticated, an attacker can move or copy a crafted directory and cause commands to run as the web‑server user. Given the high impact and the absence of public exploit availability, the risk to systems that have allowed authenticated users access to the storage function remains significant.