High severity · published Oct 28, 2026
CVE-2026-118755
Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path
New
7.2
CVSS
–
EPSS
No
On KEV
Description
Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell metacharacters such as $(...) and then move or copy it, running commands as the web server user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PE
personal-management-system · Volmarg
through 2.1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118755
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118755
github.com
https://github.com/Volmarg/personal-management-system
github.com
https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Shell/ShellAbstractService.php#L55-L76
github.com
https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Shell/ShellTreeService.php#L71-L102
github.com
https://github.com/Volmarg/personal-management-system/issues/165
www.vulncheck.com
https://www.vulncheck.com/advisories/volmarg-personal-management-system-through-2.1.0-os-command-injection-via-storage-folder-path
More from personal-management-system
6.5
CVE-2026-40526
Volmarg Personal Management System Path Traversal via get-file Endpoint