CVE-2026-82678
Received Received - Intake

Diem Administrative Console OS Command Injection Vulnerability

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description
A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. Such manipulation of the argument dm_command leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82678
EUVD
EUVD-2026-68459

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
diem-project diem to 5.1.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82678 is an OS command injection flaw in the Diem project's administrative console. The vulnerability exists in the executeCommand function of the dmAdminPlugin/modules/dmConsole/actions/actions.class.php file. The issue occurs because the console only validates the first token of a command against an allowlist but then executes the entire untrusted input string through a shell. Attackers can bypass restrictions by appending shell metacharacters and command substitutions after an allowed command.

Detection Guidance

Check for unauthorized command execution attempts in logs, particularly for the administrative console. Look for unusual commands or sequences like ';', '&&', or '$(' in the dm_command parameter. Monitor network traffic for suspicious outbound connections from the web server process.

Impact Analysis

An attacker with access to the administrative console can exploit this to execute arbitrary OS commands with the privileges of the PHP/web-server process. This could lead to data theft, application manipulation, or host takeover. The exploit is publicly available and can be launched remotely.

Compliance Impact

This vulnerability allows remote attackers with administrative console access to execute arbitrary OS commands. This could lead to unauthorized data access, modification, or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information.

Mitigation Strategies

Immediately update to the latest version of Diem if a patch is available. If not, disable the administrative console plugin or restrict access to it via network controls. Implement strict input validation for the dm_command parameter and replace shell execution with safe APIs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82678. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart