Description
Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell metacharacters such as $(...) and then move or copy it, running commands as the web server user.
Published: 2026-10-28
Score: 8.6 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell metacharacters such as $(...) and then move or copy it, running commands as the web server user.
Title Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path
First Time appeared Personal-management-system
Personal-management-system personal Management System
Weaknesses CWE-78
CPEs cpe:2.3:a:personal-management-system:personal_management_system:*:*:*:*:*:*:*:*
Vendors & Products Personal-management-system
Personal-management-system personal Management System
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Personal-management-system Personal Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-28T21:11:23.608Z

Reserved: 2026-10-28T19:13:09.480Z

Link: CVE-2026-118755

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T22:17:14.370

Modified: 2026-10-28T22:17:14.370

Link: CVE-2026-118755

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T22:30:12Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')