Description

A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the file dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.php of the component Widget Editor. Performing a manipulation results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-31T11:16:40.000Z",
  "pubdate": "2026-08-31T11:16:40.000Z",
  "executiveSummary": "A critical security vulnerability exists in the Widget Editor component of the diem-project diem framework, affecting versions up to 5.1.3.\nThe vulnerability is classified as an unrestricted file upload flaw, which allows remote attackers to bypass security restrictions and upload arbitrary files to the server.\nThis flaw resides within the dmWidgetContentBaseMediaForm.php file. By manipulating the input parameters of the affected function, a remote actor can successfully inject malicious files.\nThe successful exploitation of this vulnerability poses a severe risk, as it potentially enables remote code execution (RCE) if an attacker uploads executable scripts (e.g., PHP files) to a web-accessible directory.\nThis vulnerability is particularly dangerous because the exploit code has been made publicly available, increasing the likelihood of active exploitation by threat actors.\nThe vendor has been notified through an issue report but has not yet provided a patch or formal response, leaving systems running the affected versions vulnerable to unauthorized file operations.",
  "technicalDetails": "The vulnerability is located in the dmWidgetContentBaseMediaForm.php file, which serves as a component of the Widget Editor within the diem-project diem framework (up to v5.1.3). The core of the issue is an improper validation mechanism for uploaded files, resulting in an Unrestricted File Upload vulnerability.\nThe flaw occurs because the application fails to adequately sanitize or restrict the MIME types, extensions, or contents of files uploaded through the media widget interface. When a user interacts with the file upload form handled by dmWidgetContentBaseMediaForm.php, the server-side logic does not verify that the uploaded file conforms to expected media standards (e.g., JPEG, PNG).\nAn attacker can exploit this by intercepting the upload request and modifying the filename or the content of the multipart/form-data payload. By submitting a file with a malicious extension—such as a .php, .php5, or .phtml file—in an environment where the web server is configured to execute scripts within the upload directory, the attacker can achieve Remote Code Execution (RCE).\nThe attack flow follows these steps: First, the attacker identifies a public-facing instance of the diem application. Second, the attacker accesses the Widget Editor functionality, specifically targeting the media upload component. Third, the attacker initiates an upload request and substitutes the legitimate file with a malicious script containing web shell code. Fourth, due to the lack of server-side filtering, the application saves the malicious file to the server's filesystem. Finally, the attacker navigates to the URL where the uploaded file is stored, triggering the execution of the injected code by the web server.\nThe impact of this vulnerability is critical. Beyond unauthorized file storage, which could consume server resources, the ability to execute arbitrary code provides the attacker with full control over the application's environment. This facilitates data exfiltration, database manipulation, defacement, or the establishment of a persistent backdoor for future access. As the exploit is public, threat actors can automate this process against exposed diem instances with minimal effort, requiring no authentication if the widget is exposed on a public-facing page."
}