Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell metacharacters such as $(...) and then move or copy it, running commands as the web server user.

Etkilenen sürümler1 yazılım

Kaynaklar7 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/Volmarg/personal-management-system/issues/165 Üçüncü taraf
• vulncheck.com/…0-os-command-injection-via-storage-folder-path Üçüncü taraf
• github.com/Volmarg/personal-management-system Diğer
• github.com/….0/src/Services/Shell/ShellAbstractService.php Diğer
• github.com/…v2.1.0/src/Services/Shell/ShellTreeService.php Diğer

Kayıt geçmişi

1. 29 Eki 2026 00:11Yayımlandı

İlgili açıklar

• 7,0 CVE-2026-118692CherryTree through 1.7.2 OS Command Injection via Custom Web Link Action
• 8,8 CVE-2026-78674Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution
• 7,8 CVE-2026-118615Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability
• 6,8 CVE-2026-118607Alpine iLX-F511 diagapp Command Injection Vulnerability
• 8,8 CVE-2026-106079Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration
• 9,8 CVE-2026-103406Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.