Is CVE-2026-82678 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82678 being exploited in the wild.

How severe is CVE-2026-82678?

Medium severity, with a CVSS score of 4.7, published 31 August 2026.

Is there a fix for CVE-2026-82678?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82678 attacked?

It is attacked over the network.

Am I affected by CVE-2026-82678?

Check whether you run Diem-Project Diem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82678: diem-project Diem OS command injection in Administrative Console

CVE-2026-82678 · Severity: medium · CVSS 4.7 · Published 2026-08-31

Diem is a content management framework for PHP projects. The administrative console feature contains a command execution vulnerability that allows authenticated administrators to bypass intended command restrictions and run arbitrary system commands with the privileges of the web server process, potentially leading to unauthorized access to sensitive data or system compromise.

Technologies: Diem-Project Diem. Vendors: Diem-Project.

Quick answers

Is CVE-2026-82678 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82678 being exploited in the wild.
How severe is CVE-2026-82678?: Medium severity, with a CVSS score of 4.7, published 31 August 2026.
Which products and versions are affected?: Diem-Project Diem up to 5.1.3.
Is there a fix for CVE-2026-82678?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82678 attacked?: It is attacked over the network.
Am I affected by CVE-2026-82678?: Check whether you run Diem-Project Diem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an OS command injection in dmAdminPlugin/modules/dmConsole/actions/actions.class.php. The executeCommand function validates only the first space-delimited token of user input against an allowlist of permitted commands (such as "ls"), then passes the entire unvalidated input string to the shell via passthru(). An attacker can bypass this by appending shell metacharacters (e.g., "ls ; id #") after an allowed command, with comment characters masking appended options. The attack requires authentication with administrative console privileges and network access to the admin interface. An attacker can execute arbitrary OS commands with the privileges of the PHP/web-server process, potentially accessing configuration files, credentials, or taking over the application host. The vulnerability was reported on 2026-07-17, a public proof-of-concept exists, and the project had not provided a patch as of the advisory date.

Affected products

diem-project Diem up to 5.1.3

Timeline

2026-07-17: disclosed: Issue reported via GitHub #447
2026-08-31: advisory: CVE-2026-82678 published
2026-07-17: other: Public exploit available; project did not respond to early notification

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.