CVE-2026-118755 Details
Description
Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell metacharacters such as $(...) and then move or copy it, running commands as the web server user.
A command injection vulnerability has been identified in Volmarg Personal Management System versions through 2.1.0. This vulnerability allows authenticated users to execute arbitrary shell commands by exploiting unescaped folder paths in the storage module's tree command. Attackers can create directories under 'upload/files' containing shell metacharacters, such as '$(...)', and then move or copy these directories, executing commands as the web server user.
The vulnerability can be fixed by avoiding the use of a shell to execute commands. Instead, use the array form of the Process class, which safely handles command arguments without shell interpretation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Volmarg Personal Management System | <= 2.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |