CVE-2026-112138 in diem
Summary
by MITRE • 10/19/2026
A flaw has been found in diem-project diem up to 5.1.3. The impacted element is the function dmOs::join of the file dmFrontPlugin/modules/dmCodeEditor/actions/actions.class.php of the component dmCodeEditor. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in diem-project versions up to 5.1.3 represents a critical security flaw within the dmCodeEditor component, specifically located in the join function of the actions.class.php file under the dmFrontPlugin modules directory. This issue is classified as a Path Traversal vulnerability, which falls under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The core technical failure lies in the insufficient validation and sanitization of user-supplied input before it is processed by the application logic. When an attacker provides a manipulated file path or parameter containing directory traversal sequences such as dot-dot-slash, the system fails to properly restrict access to the intended local resources. Instead, this allows the execution context to escape the designated secure directory boundaries and interact with arbitrary files on the underlying operating system.
From an operational perspective, this vulnerability enables remote attackers to read sensitive configuration files, source code containing credentials or API keys, or other critical data stored outside of the web root. The ability to launch this attack remotely significantly increases its severity because it does not require local access or authentication in many configurations where user input is accepted without strict checks. Although the project maintainers were notified via an issue report early on, their lack of response leaves systems relying on these older versions exposed to active exploitation. Publicly available exploits for this flaw mean that automated scanning tools and malicious actors can easily identify vulnerable instances and execute attacks with minimal effort, leading to potential data breaches or further system compromise through subsequent steps like remote code execution if combined with other vulnerabilities.
In the context of industry frameworks such as MITRE ATT&CK, this vulnerability aligns with techniques related to Collection and Exfiltration, specifically where an attacker accesses local system files to gather intelligence about the environment before moving laterally or exfiltrating data. The lack of input validation is a fundamental design flaw that violates secure coding principles outlined in standards like OWASP Top 10 under Injection categories. To mitigate this risk immediately, organizations should upgrade to a patched version of diem-project if one becomes available from the maintainers. In the interim, since no patch has been issued by the vendor, it is imperative to implement compensating controls at the web server or application firewall level. These controls should include strict input validation that rejects any path containing traversal characters and enforces allow-listing for file access operations. Additionally, restricting file system permissions so that the web service account cannot read sensitive directories outside its working scope can limit the blast radius of a successful exploitation attempt.