Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
The Volmarg Personal Management System (through version 2.1.0 is excluded per instructions, so: the Volmarg Personal Management System web application) contains a flaw that lets logged-in users run arbitrary operating system commands on the server by crafting folder names, potentially giving them control with the privileges of the web server account.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell metacharacters such as $(...) and then move or copy it, running commands as the web server user.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Volmarg personal-management-system
through 2.1.0