CVE-2026-112041 Details
Description
A vulnerability was identified in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This vulnerability affects the function dmString::random of the file dmCorePlugin/lib/basic/dmString.php. Such manipulation leads to cryptographically weak prng. The attack may be performed from remote. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability exists in the Diem content management framework for PHP, specifically in versions up to commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. The issue arises in the 'dmString::random' function within 'dmCorePlugin/lib/basic/dmString.php', where the 'rand()' function is used to generate random strings. This method is not suitable for cryptographic purposes, leading to predictable random number generation. The vulnerability can be exploited remotely, although it requires a high level of complexity. The exploit is publicly available.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/diem-project/diem/ | [email protected] | Vendor |
| https://github.com/diem-project/diem/issues/458 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-112041 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1008084 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/421689 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/421689/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-331 | Insufficient Entropy | [email protected] |
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| diem-project diem | 116974edfb9a5b8bd69cb13586dc62bcdbb485ad |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |