---
id: CVE-2026-112039
title: >-
  diem-project diem Administrative Console actions.class.php append cross site
  scripting
summary: >-
  A vulnerability was found in diem-project diem up to
  116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this issue is the
  function append of the file
  dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component
  Administr…
severity: low
cvss: 2.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-79
  - CWE-94
vendor: diem-project
product: diem
affected:
  - diem 116974edfb9a5b8bd69cb13586dc62bcdbb485ad
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T01:30:21.462Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112039'
references:
  - url: 'https://vuldb.com/vuln/421687'
    label: >-
      VDB-421687 | diem-project diem Administrative Console actions.class.php
      append cross site scripting
  - url: 'https://vuldb.com/vuln/421687/cti'
    label: 'VDB-421687 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-112039'
    label: CVE-2026-112039 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1008082'
    label: >-
      Submit #1008082 | diem-project diem
      116974edfb9a5b8bd69cb13586dc62bcdbb485ad Cross Site Scripting
  - url: 'https://github.com/diem-project/diem/issues/456'
  - url: 'https://github.com/diem-project/diem/'
tags:
  - cve.org
ingestedAt: '2026-10-19T01:55:59.832Z'
---

## Overview

A vulnerability was found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this issue is the function append of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. The manipulation of the argument dm_command results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

## Affected

- `diem 116974edfb9a5b8bd69cb13586dc62bcdbb485ad`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.