CVE-2026-82678: diem-project diem Administrative Console actions.class.php executeCommand os command injection
A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. Such manipulation of the argument dmcommand leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must have high privileges, according to the published vector. The attack can be launched remotely and does not require user interaction.
Which component and input are affected?
The issue affects the Administrative Console's executeCommand function in dmAdminPlugin/modules/dmConsole/actions/actions.class.php. It is triggered by manipulation of the dm_command argument.
Is public exploitation material available?
Yes. A public exploit is available and may be used by attackers.
What versions are known to be affected?
diem-project diem versions up to and including 5.1.3 are identified as affected.
Is a vendor fix available?
The provided information does not identify a fix. It states that the project was notified through an issue report but had not responded at the time of publication.