{"id":"CVE-2026-112039","kind":"vulnerability","aliases":["CVE-2026-112039"],"related":[],"title":"diem: reflected cross-site scripting in administrative console command parameter","description":"A vulnerability was found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this issue is the function append of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. The manipulation of the argument dm_command results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The diem project's administrative console appends the dm_command argument to output without escaping it, so a crafted link can run script in a logged-in admin's browser. The exploit is public, and the project has not responded to the report.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["diem","package","php","self-hosted"],"not_affected_if":["diem-not-deployed"],"how_to_check":"- Check whether the diem admin console (dmAdminPlugin/modules/dmConsole) is deployed on your servers, for example by looking for `dmAdminPlugin` in the project tree.\n- Check the deployed commit against `116974edfb9a5b8bd69cb13586dc62bcdbb485ad`; the sources say the project is a rolling release with no version numbers.","fix":"- unknown: the sources report no fixed version and the project has not responded. Restrict access to the admin console to trusted networks and do not open console links from untrusted sources.","status":"open","published_at":"2026-10-19T02:17:06+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:46:10+00:00","updated_at":"2026-10-25T04:46:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:46:10Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources report no fixed version and the project has not responded. Restrict access to the admin console to trusted networks and do not open console links from untrusted sources.","reach":"internet","title":"diem: reflected cross-site scripting in administrative console command parameter","impact":"low","summary":"The diem project's administrative console appends the dm_command argument to output without escaping it, so a crafted link can run script in a logged-in admin's browser. The exploit is public, and the project has not responded to the report.","category":"package","nicknames":[],"who_cares":["diem","php","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"script runs in an admin's browser session","analyst_note":"Confirm whether the admin console is reachable by default and whether any fixed commit exists; source is NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-112039.","how_to_check":"- Check whether the diem admin console (dmAdminPlugin/modules/dmConsole) is deployed on your servers, for example by looking for `dmAdminPlugin` in the project tree.\n- Check the deployed commit against `116974edfb9a5b8bd69cb13586dc62bcdbb485ad`; the sources say the project is a rolling release with no version numbers.","needs_analyst":true,"not_affected_if":["diem-not-deployed"],"who_is_affected":"Teams running the diem project's administrative console, which is the dmConsole module in dmAdminPlugin. The sources do not say which deployments enable it by default. Teams that do not run diem can skip this.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000634,"input_tokens":3429,"output_tokens":582,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-112039':14A,17A '-2026':13A,16A '116974edfb9a5b8bd69cb13586dc62bcdbb485ad':79C 'admin':52B 'administr':8A,28B,95C 'affect':80C,139C 'append':30B,87C 'argument':34B,101C 'attack':110C 'browser':54B 'command':10A,33B,103C 'compon':94C 'consol':9A,29B,96C 'could':122C 'craft':42B 'cross':4A,106C 'cross-sit':3A 'cve':12A,15A 'deliveri':133C 'diem':1A,18B,25B,74C,76C 'diem-project':73C 'dm':32B,102C 'dmadminplugin/modules/dmconsole/actions/actions.class.php':91C 'earli':152C 'escap':38B 'execut':113C 'exploit':56B,116C 'file':90C 'found':71C 'function':86C 'host':23B 'implement':127C 'inform':137C,148C 'issu':83C,155C 'link':43B 'log':50B 'logged-in':49B 'made':119C 'manipul':98C 'mean':135C 'ongo':132C 'output':36B 'packag':19B 'paramet':11A 'php':20B 'problem':151C 'product':126C 'project':26B,61B,75C,146C 'public':58B,120C 'reflect':2A 'releas':130C,142C 'remot':114C 'report':67B,156C 'respond':64B,160C 'result':104C 'roll':129C 'run':45B 'script':6A,46B,108C 'self':22B 'self-host':21B 'site':5A,107C 'unavail':144C 'updat':141C 'use':124C 'version':136C 'vulner':69C 'without':37B 'yet':161C","nicknames":[],"mitigations":[],"who_affected":"Teams running the diem project's administrative console, which is the dmConsole module in dmAdminPlugin. The sources do not say which deployments enable it by default. Teams that do not run diem can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T02:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112039","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112039","severity":null,"published_at":"2026-10-19T02:17:06+00:00","modified_at":"2026-10-19T17:17:08+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}