Volmarg Personal Management System 2.1.0 發現 OS 命令注入漏洞

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell metacharacters such as $(...) and then move or copy it, running commands as the web server user.

Impact

Affected Products

The following products are affected by CVE-2026-118755 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Patch the application to sanitize user-supplied input for folder paths.

• Update Volmarg Personal Management System to a patched version.
• Sanitize all user-supplied folder path inputs.
• Avoid using shell metacharacters in folder names.

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-118755.

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-118755 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-118755 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-118755 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-118755 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

• New CVE Received by [email protected]

  十月. 28, 2026

  Action	Type	Old Value	New Value
  Added	Description		Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell metacharacters such as $(...) and then move or copy it, running commands as the web server user.
  Added	CVSS V4.0		AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  Added	CVSS V3.1		AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  Added	CWE		CWE-78
  Added	Affected		New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/118xxx/CVE-2026-118755.json">CVE-2026-118755</a>
  Added	Reference		https://github.com/Volmarg/personal-management-system
  Added	Reference		https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Shell/ShellAbstractService.php#L55-L76
  Added	Reference		https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Shell/ShellTreeService.php#L71-L102
  Added	Reference		https://github.com/Volmarg/personal-management-system/issues/165
  Added	Reference		https://www.vulncheck.com/advisories/volmarg-personal-management-system-through-2.1.0-os-command-injection-via-storage-folder-path

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.