---
id: "CVE-2026-112030"
kind: "vulnerability"
aliases: ["CVE-2026-112030"]
title: "Diem: default password in data loader lets remote attackers in"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["diem", "package", "php", "self-hosted"]
not_affected_if: ["default-password-changed"]
published_at: "2026-10-19T00:16:30+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T03:57:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112030", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Diem: default password in data loader lets remote attackers in

Diem, a PHP content management project, ships a data loader file (dmCorePlugin/lib/data/dmDataLoad.php) that uses a default password. A remote attacker who knows or guesses that default can perform actions the password protects.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Diem version against `5.1.3`; versions up to and including `5.1.3` are listed as affected.
- Look for the default password in `dmCorePlugin/lib/data/dmDataLoad.php` and confirm whether it has been changed.

## Fix

- The sources do not name a fixed version: unknown.
- Change the default password in the configuration to a unique value, as the description suggests updating the configuration settings.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112030

## From the sources

A vulnerability was found in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmCorePlugin/lib/data/dmDataLoad.php. Performing a manipulation results in use of default password. The attack is possible to be carried out remotely. The exploit has been made public and could be used. It is suggested to update the configuration settings. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_