A vulnerability was identified in diem-project diem up to 5.1.3. (CVE-2026-82678)

CVE-2026-82678 is an OS command injection vulnerability in diem-project diem up to version 5.1.3. The flaw resides in the executeCommand function of the dmAdminPlugin/modules/dmConsole/actions/actions.class.php file within the Administrative Console component. An attacker can manipulate the dm_command argument to execute arbitrary OS commands remotely. The vulnerability was responsibly disclosed early but remains unpatched. A public exploit exists, but no evidence of active exploitation in the wild has been reported.

Successful exploitation allows an attacker with high privileges to execute arbitrary operating system commands remotely, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS score of 4.7 reflects low severity due to the requirement of high privileges and no user interaction needed.

No official patch or remediation is currently available. Users should monitor the vendor's advisory channels for updates. Until a fix is provided, restrict access to the Administrative Console to trusted users only and consider additional network-level protections to limit exposure.