Description
A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. Such manipulation of the argument dm_command leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-08-31
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the executeCommand function within the Administrative Console of diem. By supplying a crafted dm_command value, an attacker can inject arbitrary operating‑system commands, leading to execution outside the intended scope. The flaw permits remote exploitation with no local privilege requirement, and an exploit is publicly available.

Affected Systems

The affected product is diem issued by diem-project. Versions up to and including 5.1.3 are vulnerable. No other impacted products are listed.

Risk and Exploitability

The CVSS base score of 5.1 denotes medium severity. The EPSS score is not available, but the vulnerability is not in the CISA KEV list. The attack vector is remote, with the error being uncovered in a public repository, suggesting that attackers could target exposed instances. The risk remains moderate unless mitigated by disabling the vulnerable function or restricting console access.

Generated by OpenCVE AI on August 31, 2026 at 11:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update diem to a version where executeCommand is fixed (or the latest release if available).
  • Limit access to the Administrative Console so that only trusted administrators can use it, preferably via network segmentation or firewall rules.
  • If an update is unavailable, remove or disable the dm_command parameter or modify executeCommand to validate or whitelist allowed commands before execution.

Generated by OpenCVE AI on August 31, 2026 at 11:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 11:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 31 Aug 2026 10:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. Such manipulation of the argument dm_command leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Title diem-project diem Administrative Console actions.class.php executeCommand os command injection
First Time appeared Diem-project
Diem-project diem
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:diem-project:diem:*:*:*:*:*:*:*:*
Vendors & Products Diem-project
Diem-project diem
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Diem-project Diem
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-31T10:57:35.371Z

Reserved: 2026-08-30T16:38:33.428Z

Link: CVE-2026-82678

cve-icon Vulnrichment

Updated: 2026-08-31T10:57:27.581Z

cve-icon NVD

Status : Received

Published: 2026-08-31T11:16:39.807

Modified: 2026-08-31T11:16:39.807

Link: CVE-2026-82678

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T11:30:05Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')