CVE-2026-86182: Cross-Site Request Forgery in diem-project diem

This vulnerability in diem-project diem up to version 5.1.3 affects the executeCommand function in dmAdminPlugin/modules/dmConsole/actions/actions.class.php. It allows an attacker to perform cross-site request forgery by manipulating the dm_command argument, potentially causing unauthorized command execution. The vulnerability is remotely exploitable without privileges and requires user interaction. The project was notified early but has not issued a patch or official response. The CVSS 4.0 base score is 5.3, indicating medium severity.

Successful exploitation can lead to unauthorized execution of commands via the dmConsole component by tricking an authenticated user into submitting a crafted request. This could result in unauthorized actions being performed on the affected system. There is no indication of privilege escalation, confidentiality, integrity, or availability impact beyond the CSRF attack vector. No active exploitation in the wild has been reported.

No official fix or patch has been released by the vendor as of now. Users should monitor the vendor's advisories for updates. In the meantime, applying standard CSRF mitigations such as enforcing anti-CSRF tokens, validating request origins, or restricting access to the dmConsole interface can help reduce risk. Since the vendor has not responded, organizations should consider limiting access to affected components and applying web application firewall rules to detect and block suspicious requests targeting dm_command parameters.