Live › vulnerability › CVE-2026-112138
Go to dashboardA path traversal flaw in the dmCodeEditor module of diem-project diem up to 5.1.3 lets a remote attacker manipulate file paths handled by dmOs::join. The exploit is public and the project has not yet responded to the report.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running diem-project diem up to 5.1.3 with the dmCodeEditor module present. The sources do not say whether an account is needed to reach the editor actions, so unknown. Installations without this module or on a newer release are not covered by this report.
No product ranges from the sources yet.
5.1.3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in diem-project diem up to 5.1.3. The impacted element is the function dmOs::join of the file dmFrontPlugin/modules/dmCodeEditor/actions/actions.class.php of the component dmCodeEditor. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-112138")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.