Volmarg Personal Management System OS command injection (CVE-2026-118755)
Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability in the storage module that allows authenticated users to execute shell commands via unescaped folder paths.
CVE search metadata
CVE search record: CVE-2026-118755. Severity: high. CVSS: 7.2. KEV: no. Product: Volmarg Personal Management System through 2.1.0. Brief: Volmarg Personal Management System OS command injection (CVE-2026-118755). Brief link: https://feed.craftedsignal.io/briefs/2026-10-volmarg-cve-2026-118755/
Triage facts
Revision 1- Applicability
- Volmarg Personal Management System through 2.1.0
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 28, 22:48 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability. Authenticated users can execute shell commands via unescaped folder paths in the storage module's tree command. By creating a directory under upload/files containing shell metacharacters such as $(...) and performing a move or copy operation, commands are executed as the web server user.