CVE-2026-112030: diem-project diem dmDataLoad.php default password
A vulnerability was found in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmCorePlugin/lib/data/dmDataLoad.php. Performing a manipulation results in use of default password. The attack is possible to be carried out remotely. The exploit has been made public and could be used. It is suggested to update the configuration settings. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects diem-project diem versions up to and including 5.1.3. The affected code is identified as dmCorePlugin/lib/data/dmDataLoad.php.
What access does an attacker need?
The attack can be performed remotely, but the supplied severity vector indicates that low-level privileges are required. No user interaction is required.
Is exploitation likely to be practical?
A public exploit is available, and the attack complexity is rated low. The reported impact includes limited confidentiality, integrity, and availability effects.
What should teams do if they cannot patch?
Update the relevant configuration settings, particularly to ensure default passwords are not in use. The vendor was reportedly notified through an issue report but had not responded at the time of reporting.