---
id: "CVE-2026-112039"
kind: "vulnerability"
aliases: ["CVE-2026-112039"]
title: "diem: reflected cross-site scripting in administrative console command parameter"
severity: "low"
cvss: 3.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["diem", "package", "php", "self-hosted"]
not_affected_if: ["diem-not-deployed"]
published_at: "2026-10-19T02:17:06+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T04:46:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112039", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# diem: reflected cross-site scripting in administrative console command parameter

The diem project's administrative console appends the dm_command argument to output without escaping it, so a crafted link can run script in a logged-in admin's browser. The exploit is public, and the project has not responded to the report.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the diem admin console (dmAdminPlugin/modules/dmConsole) is deployed on your servers, for example by looking for `dmAdminPlugin` in the project tree.
- Check the deployed commit against `116974edfb9a5b8bd69cb13586dc62bcdbb485ad`; the sources say the project is a rolling release with no version numbers.

## Fix

- unknown: the sources report no fixed version and the project has not responded. Restrict access to the admin console to trusted networks and do not open console links from untrusted sources.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112039

## From the sources

A vulnerability was found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this issue is the function append of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. The manipulation of the argument dm_command results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_