Vulnerability · Published Jun 18, 2026 · Assigned by CERT-PL
CVE-2026-40456OS Command Injection in LMS
High 8.6
In plain English
A high-severity OS command injection in LMS from LMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Severity (CVSS 4.0)8.6High
Exploit odds (30 days)0.9%top 38.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An OS Command Injection vulnerability exists in LMS (LAN Management System) before commit 9fcb4de due to an IP address parameter being passed to the "exec()" function without proper validation, allowing attackers to execute arbitrary operating system commands.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
References
- https://github.com/chilek/lms/commit/9fcb4de19b7d76394898dbc124252b86b07ac0ed patch
- https://cert.pl/posts/2026/06/CVE-2026-40455 third-party-advisory
- https://lms.org.pl/ product