OS Command Injection in Volmarg Personal Management System Affects Multiple Versions

CVE-2026-118755

What is CVE-2026-118755?

The Volmarg Personal Management System, in versions up to 2.1.0, is susceptible to an OS command injection flaw. This vulnerability can be exploited by authenticated users who manipulate folder paths to inject shell metacharacters, enabling them to execute arbitrary commands via the storage module's tree command. The exploit occurs when these attackers create directories with malicious code under upload/files and perform operations such as moving or copying, thereby invoking commands as the web server user. This poses a significant security risk as it can lead to unauthorized access and control over the affected systems.

References