{"id":"CVE-2026-112138","kind":"vulnerability","aliases":["CVE-2026-112138"],"related":[],"title":"Diem CMS: code editor path traversal lets remote users reach arbitrary files","description":"A flaw has been found in diem-project diem up to 5.1.3. The impacted element is the function dmOs::join of the file dmFrontPlugin/modules/dmCodeEditor/actions/actions.class.php of the component dmCodeEditor. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"A path traversal flaw in the dmCodeEditor module of diem-project diem up to 5.1.3 lets a remote attacker manipulate file paths handled by dmOs::join. The exploit is public and the project has not yet responded to the report.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["diem","package","php","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed diem version in the project's composer.json or lock file against `5.1.3`\n- Confirm whether the dmCodeEditor plugin (dmFrontPlugin/modules/dmCodeEditor) is present and reachable on the admin interface","fix":"- No fixed version is named in the sources: unknown\n- Restrict access to the admin and code editor routes, or disable the dmCodeEditor module, until a patched release is published","status":"open","published_at":"2026-10-19T12:17:01+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:10:17+00:00","updated_at":"2026-10-25T04:10:17+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:10:17Z","model":"claude-haiku-5-5","output":{"fix":"- No fixed version is named in the sources: unknown\n- Restrict access to the admin and code editor routes, or disable the dmCodeEditor module, until a patched release is published","reach":"internet","title":"Diem CMS: code editor path traversal lets remote users reach arbitrary files","impact":"medium","summary":"A path traversal flaw in the dmCodeEditor module of diem-project diem up to 5.1.3 lets a remote attacker manipulate file paths handled by dmOs::join. The exploit is public and the project has not yet responded to the report.","category":"package","nicknames":[],"who_cares":["diem","php","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote attacker reads or writes files outside the intended directory","analyst_note":"Confirm whether the editor actions require admin login and whether a fixed version exists; check the NVD entry and the project's issue tracker.","how_to_check":"- Check the installed diem version in the project's composer.json or lock file against `5.1.3`\n- Confirm whether the dmCodeEditor plugin (dmFrontPlugin/modules/dmCodeEditor) is present and reachable on the admin interface","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Sites running diem-project diem up to 5.1.3 with the dmCodeEditor module present. The sources do not say whether an account is needed to reach the editor actions, so unknown. Installations without this module or on a newer release are not covered by this report.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000616,"input_tokens":3348,"output_tokens":563,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112138':15A,18A '-2026':14A,17A '5.1.3':40B,78C 'arbitrari':11A 'attack':44B,104C 'cms':2A 'code':3A 'compon':93C 'cve':13A,16A 'diem':1A,19B,35B,37B,73C,75C 'diem-project':34B,72C 'dmcodeeditor':31B,94C 'dmfrontplugin/modules/dmcodeeditor/actions/actions.class.php':90C 'dmos':50B,85C 'earli':125C 'editor':4A 'element':81C 'execut':95C 'exploit':53B,110C 'file':12A,46B,89C 'flaw':28B,67C 'found':70C 'function':84C 'handl':48B 'host':24B 'impact':80C 'inform':121C 'issu':128C 'join':51B,86C 'launch':107C 'lead':99C 'let':7A,41B 'manipul':45B,97C 'may':115C 'modul':32B 'packag':20B 'path':5A,26B,47B,101C 'php':21B 'problem':124C 'project':36B,58B,74C,119C 'public':55B 'publish':113C 'reach':10A 'remot':8A,43B,108C 'report':65B,129C 'respond':62B,133C 'self':23B 'self-host':22B 'travers':6A,27B,102C 'use':117C 'user':9A 'yet':61B,134C","nicknames":[],"mitigations":[],"who_affected":"Sites running diem-project diem up to 5.1.3 with the dmCodeEditor module present. The sources do not say whether an account is needed to reach the editor actions, so unknown. Installations without this module or on a newer release are not covered by this report.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T12:17:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112138","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112138","severity":null,"published_at":"2026-10-19T12:17:01+00:00","modified_at":"2026-10-19T19:17:25+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}