Affected components of diem allow an attacker to manipulate the dm_command argument in the executeCommand function of dmConsole’s actions.class.php. This flaw is a Cross‑Site Request Forgery that enables the attacker to trigger arbitrary commands on the target system. The resulting execution can compromise confidentiality, integrity, and availability of the affected application and any data it manages.

The vulnerability exists in diem‑project diem releases up to version 5.1.3, inclusive. The specific file implicated is dmAdminPlugin/modules/dmConsole/actions/actions.class.php within the dmConsole module. Users running any of these versions should verify they are not exposed to the flaw.

The CVSS score of 5.3 indicates moderate severity. Although the EPSS score is not available, the exploit has been publicly disclosed and is actively usable, meaning the likelihood of exploitation is significant for exposed users. The flaw is not listed in the CISA KEV catalog, but the public nature of the vulnerability and the nature of CSRF imply that compromise can occur without privileged access to the server. An attacker can typically initiate the exploit from an external domain by crafting a forged request that exploits an authenticated session or relies on inadequate CSRF protection.