# CVE-2026-82679: Diem CMF unrestricted file upload in widget editor

Source: https://junglewise.ai/threats/cve-2026-82679-diem-cmf-unrestricted-file-upload-in-widget-editor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82679 · Severity: medium · CVSS 6.3 · Published 2026-08-31

Diem is an open-source content management framework built on Symfony. A vulnerability in the widget editor component allows authenticated users with widget-editing privileges to upload arbitrary files, including PHP scripts, to a web-accessible directory. If the web server is configured to execute PHP files, this enables remote code execution under the web server's account.

Technologies: [Diem-Project Diem](https://junglewise.ai/threats/technologies/diem). Vendors: [Diem-Project](https://junglewise.ai/threats/vendors/diem-project).

## Quick answers

**Is CVE-2026-82679 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82679 being exploited in the wild.

**How severe is CVE-2026-82679?** Medium severity, with a CVSS score of 6.3, published 31 August 2026.

**Which products and versions are affected?** Diem-Project Diem up to 5.1.3.

**Is there a fix for CVE-2026-82679?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82679 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-82679?** Check whether you run Diem-Project Diem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an unrestricted file upload flaw in the widget media form component (dmFrontPlugin/lib/dmWidget/media/dmWidgetContentBaseMediaForm.php). The vulnerable code uses sfValidatorFile without enforcing a file-type allowlist and uploads files to /uploads/widget/ with their original extensions intact. An authenticated attacker with widget_edit privileges can craft a multipart form submission to POST /index.php/+/dmWidget/edit to upload a PHP file. The file is stored in a web-accessible directory and executed by the PHP interpreter, resulting in remote code execution. The root cause is the absence of file-type validation, content inspection, or a non-executable storage policy. No patch has been released by the project maintainers.

## Affected products

- diem-project Diem up to 5.1.3

## Timeline

- 2026-07-17: disclosed: Issue reported on GitHub
- 2026-08-31: advisory: CVE published

## References

- [https://github.com/diem-project/diem/](https://github.com/diem-project/diem/)
- [https://github.com/diem-project/diem/issues/448](https://github.com/diem-project/diem/issues/448)

## Related threats

- [Diem path traversal in code editor](https://junglewise.ai/threats/cve-2026-112138-a-flaw-has-been-found-in-diem-project-diem-up-to-5-1-3-the)
- [Diem CMF open redirect in sign-in authentication](https://junglewise.ai/threats/cve-2026-112040-a-vulnerability-was-determined-in-diem-project-diem-up-to)
- [Diem CMF cross-site request forgery in admin console](https://junglewise.ai/threats/cve-2026-86182-diem-cmf-cross-site-request-forgery-in-admin-console)
- [diem-project Diem OS command injection in Administrative Console](https://junglewise.ai/threats/cve-2026-82678-diem-project-diem-os-command-injection-in-administrative-console)