CVE-2026-112138
Received Received - Intake

Path Traversal in Diem dmCodeEditor Component

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A flaw has been found in diem-project diem up to 5.1.3. The impacted element is the function dmOs::join of the file dmFrontPlugin/modules/dmCodeEditor/actions/actions.class.php of the component dmCodeEditor. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112138
EUVD
EUVD-2026-104246

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
diem-project diem 5.1.0
diem-project diem 5.1.1
diem-project diem 5.1.2
diem-project diem 5.1.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal flaw in the Diem project's code editor component. It allows attackers to read or write files outside the intended project directory by manipulating file paths with sequences like ../../../. The issue occurs because the code does not properly normalize paths before performing filesystem operations, enabling directory escape.

Detection Guidance

Check for unauthorized file access or modification in directories outside the Diem project root. Monitor HTTP requests to the code editor endpoint for traversal sequences like ../../../ in file paths. Review PHP error logs for filesystem operation failures.

Impact Analysis

An attacker could exploit this to access sensitive files like configuration files or system files writable by PHP. This may lead to unauthorized data disclosure, file modification, or even complete system compromise if critical files are targeted. The impact depends on the permissions of the web server user.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized access to personal or health data. If exploited, it may result in data breaches, violating confidentiality requirements and triggering regulatory penalties or legal consequences.

Mitigation Strategies

Disable the code_editor privilege for users until a patch is applied. Implement input validation to reject paths containing traversal sequences. Update to the latest version of Diem if a fix is available. Restrict filesystem permissions for the web server user.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112138. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart