---
id: "CVE-2026-118755"
kind: "vulnerability"
aliases: ["CVE-2026-118755"]
title: "Volmarg Personal Management System: authenticated users run shell commands via folder paths"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "personal-management-system", "fixed": [], "affected": "<= 2.1.0", "ecosystem": "composer"}]
ecosystems: []
tags: ["authenticated", "command-injection", "package", "php", "rce", "self-hosted", "volmarg"]
not_affected_if: ["auth-required", "not-internet-exposed"]
published_at: "2026-10-28T22:17:14+00:00"
first_seen_at: "2026-10-28T22:35:34+00:00"
updated_at: "2026-10-28T22:37:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118755", "first_seen_at": "2026-10-28T22:35:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-28T22:37:35+00:00"}]
---

# Volmarg Personal Management System: authenticated users run shell commands via folder paths

Volmarg Personal Management System through 2.1.0 passes unescaped folder paths to a shell in its storage module's tree command. An authenticated user who creates a folder with shell metacharacters and then moves or copies it runs commands as the web server user.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:personal-management-system affected <= 2.1.0 fixed ?

## How to check

1) Check installed version: v2.1.0 or earlier is affected (git tag / composer / release in use). 2) Find suspicious folders: find upload/files -name '*$(*' -o -name '*`*' -o -name '*;*' -o -name '*|*' -o -name '*&*'. 3) Review accounts able to log in; note first-run registration is open on a fresh instance. 4) Check web logs for POST /module/storage/folder/create and /module/storage/folder/move-or-copy with metacharacters in newDirName or currDirPath.

## Fix

No patched release as of 2026-10-28; v2.1.0 is the latest and is affected. Watch Volmarg/personal-management-system releases and issue #165. Interim: restrict access to trusted accounts only, or put the app behind a VPN/IP allowlist, and remove any folders under upload/files with names containing $( ) backticks ; | &. Upstream remedy suggested by reporter: run tree via Process array form or escapeshellarg().

## Timeline

- 2026-10-28T22:35:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118755
- 2026-10-28T22:37:35+00:00 analyst — No fixed version exists: latest release is v2.1.0 (affected) and maintainer has not responded on issue #165 (open, filed 2026-10-26 by the reporter, with PoC). Sources: VulnCheck advisory, GitHub issue, releases page. Nothing marked verified (no vendor words).

## Documents

- [advisory] VulnCheck advisory CVE-2026-118755 https://www.vulncheck.com/advisories/volmarg-personal-management-system-through-2.1.0-os-command-injection-via-storage-folder-path
- [mentions] Volmarg PMS releases (latest v2.1.0) https://github.com/Volmarg/personal-management-system/releases
- [poc] Issue #165: Authenticated OS command injection in Storage module (PoC) https://github.com/Volmarg/personal-management-system/issues/165

## From the sources

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell metacharacters such as $(...) and then move or copy it, running commands as the web server user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_