CVE-2026-52102 Details

A command injection vulnerability has been identified in the OpenMediaVault RAID management plugin, specifically in versions through 8.0.4-1. This vulnerability allows authenticated administrators to execute arbitrary commands as root on the underlying system. The issue arises from inadequate sanitization of RAID parameters before they are passed to a command execution helper, enabling the injection of shell metacharacters into the command line. The vulnerability can be exploited via an HTTP POST request to the RPC service, potentially without direct access to administrative credentials.

Users are advised to update to the openmediavault-md release that includes the fix for this vulnerability. Additionally, access to the web administration interface should be restricted to trusted management networks, and OpenMediaVault should not be exposed directly to the Internet. It is also recommended to limit the number of administrative accounts and enforce strong authentication.