Diem CMS CVE-2026-112042

Exploitation requires an authenticated low-privilege account (CVSS PR:L) capable of supplying the 'text' argument to the dmBaseLinkTag link widget within the dmWidget component, and it requires a victim to subsequently view/interact with the rendered malicious link (CVSS UI:P). These two factors - mandatory authentication and mandatory victim interaction - are the primary limits on real-world exploitability. Because Diem uses a rolling release with no fixed-version boundary and the project has not responded to the report, any deployed instance running code at or before commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad that exposes this widget to multi-user access is potentially affected; single-admin or non-shared installations have little practical exposure.

This is a medium-severity reflected/stored cross-site scripting flaw (CWE-79) in the dmWidget component of the Diem PHP CMS, scored CVSS 4.0 5.1 by the reporter (VulDB). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) indicates network-reachable, low-complexity exploitation, but it is NOT unauthenticated - PR:L requires the attacker to already hold a low-privilege account, and UI:P requires a victim to interact with the crafted content, both of which meaningfully reduce real-world risk. Impact is limited (VC:N/VI:L/VA:N) - no confidentiality or availability loss, only partial integrity, consistent with a typical XSS. Publicly available exploit code exists (referenced via the project's GitHub issue #459), which raises practical risk, but there is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation - POC availability must not be conflated with in-the-wild use. Net assessment: a legitimate but not urgent issue. The combination of required authentication, required user interaction, limited impact, and an obscure, low-footprint product places this well below the priority of a critical unauthenticated RCE despite the released exploit. Note the vendor has not responded and no patch exists, so exposure persists for deployed instances.

An attacker with a low-privilege authenticated account manipulates the 'text' argument handled by dmBaseLinkTag::text in the dmWidget component, injecting a malicious script payload that is rendered unsanitized. When another user (e.g., an admin or visitor) views the page containing the crafted link, the script executes in their browser session, enabling session/cookie theft or UI actions in their context. Public exploit code exists, lowering the barrier to reproduction, though the attack still requires both authentication and victim interaction.