CVE-2026-86182
diem-project diem dmConsole actions.class.php executeCommand cross-site request forgery
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 6, 2026
- Updated
- Sep 8, 2026
- Reserved
- Sep 5, 2026
Description
A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component dmConsole. This manipulation of the argument dm_command causes cross-site request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 5.0 Medium | AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
diemdiem-project |
|
References
- VDB-399314 | diem-project diem dmConsole actions.class.php executeCommand cross-site request forgeryvdb-entrytechnical-description
- VDB-399314 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-86182 | CVE Analysis and Reportthird-party-advisory
- Submit #896154 | diem-project diem 116974edfb9a5b8bd69cb13586dc62bcdbb485ad Cross-Site Request Forgerythird-party-advisory
- https://github.com/diem-project/diem/issues/449exploitissue-tracking
- https://github.com/diem-project/diem/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.