Path Traversal Vulnerability in Diem Project's Code Editor Component
CVE-2026-112138

5.1MEDIUM

Key Information:

Vendor: Diem-project
Status: Diem
Vendor: CVE Published:; 19 October 2026

🔔 Create Diem-project Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-112138?

A vulnerability exists in the Diem Project's dmCodeEditor component up to version 5.1.3, specifically in the function dmOs::join within actions.class.php. This flaw allows for path traversal manipulation, enabling remote attackers to access unauthorized files on the system. The issue was reported to the project maintainers but has not received a response, raising concerns about the potential for exploitation. It's crucial for users of the affected versions to take precautions and updates as necessary to safeguard their systems.

Affected Version(s)

diem 5.1.0

diem 5.1.1

diem 5.1.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-112138 - Proof of Concept