{"id":"CVE-2026-118755","kind":"vulnerability","aliases":["CVE-2026-118755"],"related":[],"title":"Volmarg Personal Management System: authenticated users run shell commands via folder paths","description":"Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell metacharacters such as $(...) and then move or copy it, running commands as the web server user.","summary":"Volmarg Personal Management System through 2.1.0 passes unescaped folder paths to a shell in its storage module's tree command. An authenticated user who creates a folder with shell metacharacters and then moves or copies it runs commands as the web server user.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"personal-management-system","fixed":[],"affected":"<= 2.1.0","ecosystem":"composer"}],"ecosystems":[],"tags":["authenticated","command-injection","package","php","rce","self-hosted","volmarg"],"not_affected_if":["auth-required","not-internet-exposed"],"how_to_check":"1) Check installed version: v2.1.0 or earlier is affected (git tag / composer / release in use). 2) Find suspicious folders: find upload/files -name '*$(*' -o -name '*`*' -o -name '*;*' -o -name '*|*' -o -name '*&*'. 3) Review accounts able to log in; note first-run registration is open on a fresh instance. 4) Check web logs for POST /module/storage/folder/create and /module/storage/folder/move-or-copy with metacharacters in newDirName or currDirPath.","fix":"No patched release as of 2026-10-28; v2.1.0 is the latest and is affected. Watch Volmarg/personal-management-system releases and issue #165. Interim: restrict access to trusted accounts only, or put the app behind a VPN/IP allowlist, and remove any folders under upload/files with names containing $( ) backticks ; | &. Upstream remedy suggested by reporter: run tree via Process array form or escapeshellarg().","status":"open","published_at":"2026-10-28T22:17:14+00:00","first_seen_at":"2026-10-28T22:35:34+00:00","triaged_at":"2026-10-28T22:36:36+00:00","updated_at":"2026-10-28T22:37:35+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T22:36:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Volmarg Personal Management System: authenticated users run shell commands via folder paths","impact":"high","summary":"Volmarg Personal Management System through 2.1.0 passes unescaped folder paths to a shell in its storage module's tree command. An authenticated user who creates a folder with shell metacharacters and then moves or copies it runs commands as the web server user.","category":"package","nicknames":[],"who_cares":["volmarg","self-hosted","php"],"confidence":0.6,"needs_auth":"yes","worst_case":"Commands run as the web server user on the host","analyst_note":"Find a vendor advisory or patched version for Volmarg past 2.1.0; the NVD entry does not give a fix.","how_to_check":"- Check the installed Volmarg version against the affected range `through 2.1.0`\n- Look for directories under `upload/files` whose names contain shell metacharacters such as `$(` or backticks\n- Review whether unknown accounts can log in to the application","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Teams that run Volmarg Personal Management System 2.1.0 or earlier with user accounts that can create and move folders in the storage module. The sources do not name a fixed version or a workaround, so the team should check the vendor for a patched release.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000581,"input_tokens":3327,"output_tokens":497,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find a vendor advisory or patched version for Volmarg past 2.1.0; the NVD entry does not give a fix.","search":"'-118755':15A,18A '-2026':14A,17A '2.1.0':39B,82C 'allow':90C 'attack':108C 'authent':5A,23B,55B,91C 'command':9A,25B,53B,71B,86C,96C,107C,127C 'command-inject':24B 'contain':83C,115C 'copi':68B,124C 'creat':58B,110C 'cve':13A,16A 'directori':112C 'execut':94C 'folder':11A,42B,60B,99C 'host':32B 'inject':26B,87C 'manag':3A,36B,79C 'management':21A 'metacharact':63B,117C 'modul':50B,104C 'move':66B,122C 'os':85C 'packag':27B 'pass':40B 'path':12A,43B,100C 'person':2A,35B,78C 'personal':20A 'personal-management-system':19A 'php':28B 'rce':29B 'run':7A,70B,126C 'self':31B 'self-host':30B 'server':75B,131C 'shell':8A,46B,62B,95C,116C 'storag':49B,103C 'system':4A,22A,37B,80C 'tree':52B,106C 'unescap':41B,98C 'upload/files':114C 'user':6A,56B,76B,92C,132C 'via':10A,97C 'volmarg':1A,33B,34B,77C 'vulner':88C 'web':74B,130C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Volmarg Personal Management System 2.1.0 or earlier with user accounts that can create and move folders in the storage module. The sources do not name a fixed version or a workaround, so the team should check the vendor for a patched release.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T22:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-118755","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118755","severity":null,"published_at":"2026-10-28T22:17:14+00:00","modified_at":"2026-10-28T22:17:14+00:00","first_seen_at":"2026-10-28T22:35:34+00:00","fetched_at":"2026-10-28T22:35:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118755:982","url":null,"severity":null,"published_at":"2026-10-28T22:37:35+00:00","modified_at":"2026-10-28T22:37:35+00:00","first_seen_at":"2026-10-28T22:37:35+00:00","fetched_at":"2026-10-28T22:37:35+00:00","note":"No fixed version exists: latest release is v2.1.0 (affected) and maintainer has not responded on issue #165 (open, filed 2026-10-26 by the reporter, with PoC). Sources: VulnCheck advisory, GitHub issue, releases page. Nothing marked verified (no vendor words)."}],"documents":[{"id":12825,"url":"https://github.com/Volmarg/personal-management-system/issues/165","title":"Issue #165: Authenticated OS command injection in Storage module (PoC)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":12826,"url":"https://www.vulncheck.com/advisories/volmarg-personal-management-system-through-2.1.0-os-command-injection-via-storage-folder-path","title":"VulnCheck advisory CVE-2026-118755","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":12827,"url":"https://github.com/Volmarg/personal-management-system/releases","title":"Volmarg PMS releases (latest v2.1.0)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}