CVE-2026-82679: Unrestricted Upload in diem-project diem

This vulnerability allows remote attackers to perform unrestricted file uploads via a flaw in the Widget Editor component of diem-project diem, affecting versions 5.1.0 through 5.1.3. The issue resides in an unspecified function in dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.php. Exploitation requires no user interaction and low privileges, and the vulnerability has a CVSS 4.0 base score of 5.3 (medium severity). The project was notified early but has not issued a fix or mitigation guidance. Public exploit code is available.

Successful exploitation could allow attackers to upload arbitrary files remotely, potentially leading to further compromise depending on the server configuration and file handling. The vulnerability requires only low privileges and no user interaction, increasing its risk. However, the impact is rated medium due to limited scope and complexity factors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official diem-project channels for updates. In the meantime, restricting file upload permissions, validating and sanitizing uploaded files, and applying network-level controls to limit exposure may help reduce risk.