CVE-2026-82678

Name of the Vulnerable Software and Affected Versions diem-project diem versions prior to 5.1.4

Description An OS command injection flaw exists in the Administrative Console component. A remote attacker can exploit this by manipulating the dm command argument passed to the executeCommand() function within the dmAdminPlugin/modules/dmConsole/actions/actions.class.php file. OS command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the server.

Recommendations As a temporary workaround, restrict access to the executeCommand() function in the Administrative Console until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.