CVE-2026-118755— Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path

Quick assessment

Affected

Volmarg personal-management-system

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Volmarg 个人管理系统（版本 2.1.0 及更早版本）存在操作系统命令注入漏洞。该漏洞允许已认证用户通过存储模块的树形命令（tree command）中未转义的文件夹路径执行 Shell 命令。攻击者可在目录下创建包含 Shell 元字符（例如）的目录，随后通过移动或复制该目录，以 Web 服务器用户身份执行任意命令。

CVSS 7.2 · High Updated Oct 29, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path

Source: CVE Program / CVE List V5

Vulnerability Description

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell metacharacters such as $(...) and then move or copy it, running commands as the web server user.

Source: CVE Program / CVE List V5