Vulnerability · Published Oct 19, 2026 · Assigned by VulDB

CVE-2026-112138diem-project diem dmCodeEditor actions.class.php join path traversal

Medium 4.7

In plain English

A medium-severity path traversal in diem from diem-project. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.3%top 73.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in diem-project diem up to 5.1.3. The impacted element is the function dmOs::join of the file dmFrontPlugin/modules/dmCodeEditor/actions/actions.class.php of the component dmCodeEditor. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
diem-project	diem	5.1.05.1.15.1.25.1.3

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

References

VDB-422243 | diem-project diem dmCodeEditor actions.class.php join path traversal vdb-entry, technical-description
VDB-422243 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-112138 | CVE Analysis and Report third-party-advisory
Submit #1013200 | diem-project diem 116974edfb9a5b8bd69cb13586dc62bcdbb485ad Absolute Path Traversal third-party-advisory
https://github.com/diem-project/diem/issues/451 exploit, issue-tracking
https://github.com/diem-project/diem/ product