Description

A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. Such manipulation of the argument dm_command leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-31T11:16:39.807Z",
  "pubdate": "2026-08-31T11:16:39.807Z",
  "executiveSummary": "The diem-project diem web framework, up to and including version 5.1.3, suffers from a critical remote OS command injection vulnerability within its Administrative Console component. Specifically, the vulnerability resides in the executeCommand function of the dmAdminPlugin/modules/dmConsole/actions/actions.class.php action class.\nDue to insufficient sanitization and validation of the user-supplied dm_command parameter, a remote attacker can inject arbitrary shell commands that are subsequently executed on the underlying operating system with the privileges of the web server process. Because the administrative interface is exposed and public exploits exist, the risk to unpatched installations is extremely high.\nSince the project maintainers have not yet released an official patch, deployments must implement manual mitigations, such as strict access controls or code-level input sanitization, to prevent unauthorized remote code execution and potential full system compromise.",
  "technicalDetails": "The vulnerability originates from a fundamental lack of input validation and sanitization within the administrative console implementation of the Diem CMS framework. The affected file, dmAdminPlugin/modules/dmConsole/actions/actions.class.php, defines an action designed to process system administration commands via the executeCommand function. This function retrieves the user-controlled parameter dm_command directly from the incoming HTTP request.\nIn a secure implementation, administrative utilities restrict execution to a strict whitelist or escape all user input. However, in the vulnerable versions of Diem, the raw string value of dm_command is passed into a system execution wrapper without adequate filtering. When the application executes the shell command, the command interpreter evaluates shell metacharacters (such as semicolons, logical operators, or backticks) supplied by the user.\nAn attacker can exploit this behavior by constructing a targeted HTTP request to the administrative console. The attack flow follows a structured path: first, the attacker locates the dmConsole endpoint; second, they format a payload within the dm_command parameter containing command concatenation characters followed by the payload (e.g., injecting a reverse shell command); third, the server receives the request and passes the input to the executeCommand function; finally, the underlying OS executes the injected commands under the security context of the web server daemon.\nThe impact of this exploitation is critical, as it allows remote attackers to execute arbitrary system commands, potentially leading to unauthorized data access, local privilege escalation, and persistent deployment of web shells or malware."
}