CVE-2026-118755

HighCVSS 7.2

Published: 28/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.41%

73th percentile - higher than 73% of all known CVEs

Summary

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell metacharacters such as $(...) and then move or copy it, running commands as the web server user.

Risk Assessment

An authenticated user can execute arbitrary shell commands with web server privileges, potentially leading to full system compromise and data leakage.

Recommendation

Update Volmarg Personal Management System to a version later than 2.1.0 and restrict user permissions to the storage module.

Other vulnerabilities in Volmarg Personal Management System

CVE-2026-40526Medium
Volmarg Personal Management System has a path traversal vulnerability allowing authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/{path} endpoint. The path parameter is passed directly to file_get_contents() without canonicalization against a permitted base directory, enabling access to sensitive files accessible to the PHP-FPM worker.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS