CVE-2026-112039 in diem
Summary
by MITRE • 10/19/2026
A vulnerability was found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this issue is the function append of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. The manipulation of the argument dm_command results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in the diem-project CMS system prior to commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad represents a critical security flaw within the Administrative Console component. Specifically, this issue resides in the append function located at dmAdminPlugin/modules/dmConsole/actions/actions.class.php. The core technical deficiency is an improper neutralization of special elements during input processing, which directly facilitates Cross-Site Scripting attacks. This class of vulnerability allows malicious actors to inject client-side scripts into web pages viewed by other users, bypassing standard security controls such as the same-origin policy that normally separate a website from the resources it loads.
The operational impact of this flaw is significant due to its remote executability and the nature of the administrative interface involved. An attacker can craft a malicious request where the dm_command argument contains script payloads rather than legitimate commands. When the application processes this input without adequate sanitization or encoding, the injected code executes in the context of the victim's browser session. This enables attackers to hijack user sessions by stealing sensitive cookies and authentication tokens, perform actions on behalf of authenticated administrators, deface web pages, or redirect users to malicious sites designed for phishing attacks. The fact that this is an administrative console increases the severity, as successful exploitation could lead to full compromise of the content management system's backend capabilities.
From a classification perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting (XSS). The attack vector is categorized under MITRE ATT&CK technique T1059.007, which refers to JavaScript execution within a browser environment. Because the exploit has been made public and is actively usable, organizations running affected versions of diem are exposed to immediate risk without requiring complex exploitation chains or specific user interaction beyond visiting a crafted URL if session cookies are not properly secured with HttpOnly flags.
Mitigation strategies must address both technical remediation and operational security practices. The primary solution involves applying the patch provided in later commits that resolve this input validation issue, ensuring that all data derived from the dm_command argument is strictly validated against an allowlist of expected commands or encoded using appropriate output encoding functions such as htmlspecialchars before being rendered into HTML context. Additionally, implementing Content Security Policy headers can help mitigate the impact of any remaining XSS vulnerabilities by restricting the sources from which scripts are allowed to execute. Administrators should also ensure that session cookies associated with the administrative console have the Secure and HttpOnly attributes enabled to reduce the risk of cookie theft via script injection. Given the rolling release model mentioned, users must verify their current commit hash against known safe versions or upgrade immediately upon confirmation of a patched release from the project maintainers.