CVE-2026-118755: Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path
Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell metacharacters such as $(...) and then move or copy it, running commands as the web server user.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of Volmarg Personal Management System through 2.1.0 are exposed if authenticated users can use the storage module to create and move or copy directories under upload/files.
What access does an attacker need to exploit it?
An attacker needs an authenticated account with the ability to create a directory under upload/files and trigger a move or copy operation in the storage module. No user interaction is required after the attacker performs those actions.
What level of access can successful exploitation provide?
Injected commands run as the web server user. The vulnerability can affect confidentiality, integrity, and availability.
How can I check for possible exploitation?
Review directories under upload/files for names containing shell metacharacters, including patterns such as $(...). Also review storage-module move and copy activity for operations involving such directory names.