CVE-2026-52102
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk77th percentile - higher than 77% of all known CVEs
Summary
An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via injecting shell metacharacters.
Risk Assessment
An attacker can gain full root control over the system, leading to complete compromise of the server and data.
Recommendation
It is recommended to immediately update the openmediavault-md plugin to a version containing a fix and avoid using unsanitized input.
Other vulnerabilities in OpenMediaVault
See all- CVE-2013-3632High
The Cron service in rpc.php in OpenMediaVault allows remote authenticated users to execute cron jobs as arbitrary users and execute arbitrary commands via the username parameter.
- CVE-2025-50674High
In OpenMediaVault 7.4.17, a vulnerability was discovered in the changePassword method in file /usr/share/php/openmediavault/system/user.inc, allowing local authenticated attackers to escalate privileges to root.
Original NVD description (English source)
An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via injecting shell metacharacters.