CVE-2026-82678: OS Command Injection in diem-project diem

This vulnerability exists in the executeCommand function of the dmAdminPlugin/modules/dmConsole/actions/actions.class.php file within the Administrative Console component of diem-project diem versions 5.1.0 through 5.1.3. Improper handling of the dm_command argument allows remote attackers to perform OS command injection. The issue was reported early to the project, but no remediation or patch has been released. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected system with the privileges of the Administrative Console component. This can lead to unauthorized system access, data compromise, or further attacks depending on the privileges of the affected process. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, no user interaction, and limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider applying workarounds such as restricting access to the Administrative Console, employing network-level controls to limit exposure, or disabling the vulnerable component until a patch is available.