---
id: "CVE-2026-112138"
kind: "vulnerability"
aliases: ["CVE-2026-112138"]
title: "Diem CMS: code editor path traversal lets remote users reach arbitrary files"
severity: "medium"
cvss: 5.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["diem", "package", "php", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-19T12:17:01+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T04:10:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112138", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# Diem CMS: code editor path traversal lets remote users reach arbitrary files

A path traversal flaw in the dmCodeEditor module of diem-project diem up to 5.1.3 lets a remote attacker manipulate file paths handled by dmOs::join. The exploit is public and the project has not yet responded to the report.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed diem version in the project's composer.json or lock file against `5.1.3`
- Confirm whether the dmCodeEditor plugin (dmFrontPlugin/modules/dmCodeEditor) is present and reachable on the admin interface

## Fix

- No fixed version is named in the sources: unknown
- Restrict access to the admin and code editor routes, or disable the dmCodeEditor module, until a patched release is published

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112138

## From the sources

A flaw has been found in diem-project diem up to 5.1.3. The impacted element is the function dmOs::join of the file dmFrontPlugin/modules/dmCodeEditor/actions/actions.class.php of the component dmCodeEditor. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_