CVE-2026-82679
Received Received - Intake

Unrestricted File Upload in Diem Project Widget Editor

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description
A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the file dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.php of the component Widget Editor. Performing a manipulation results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82679
EUVD
EUVD-2026-68460

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
diem-project diem to 5.1.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unrestricted file upload flaw in the Diem project's widget editor. It allows users with widget-editing privileges to upload PHP files to a web-accessible directory without proper validation. The issue occurs because the widget-media form does not restrict file types or extensions, enabling potential remote code execution if the server executes PHP files in that directory.

Detection Guidance

Check for unexpected PHP files in the /uploads/widget/ directory of your Diem project installation. Use commands like 'find /path/to/diem -name "*.php" -path "*/uploads/widget/*"' to locate any uploaded PHP files. Review server access logs for POST requests to the widget upload endpoint.

Impact Analysis

An attacker could exploit this to upload malicious PHP scripts, leading to remote code execution on the server. Even if PHP execution is disabled, the attacker could store harmful files for future attacks or defacement. The impact depends on server configuration and user privileges.

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or system compromise, violating compliance requirements like GDPR (data protection) and HIPAA (health data security). It may result in legal penalties, reputational damage, and failure to meet regulatory standards for data integrity and confidentiality.

Mitigation Strategies

Immediately restrict file uploads to the widget editor to only allow safe file types like images. Update the dmWidgetContentBaseMediaForm.php to implement strict file extension validation. Consider disabling PHP execution in the /uploads/widget/ directory via .htaccess or server configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82679. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart