Diem CMS EUVD-2026-104042

Requires an attacker already holding high privileges on the Diem Administrative Console (PR:H), who manipulates the dm_command argument processed by the append function in dmAdminPlugin/modules/dmConsole/actions/actions.class.php. Exploitation additionally depends on user interaction (UI:P) - a console user must view or trigger the page carrying the injected payload. Limiting factors that reduce realistic risk: the vulnerable code path is in the administrative console and therefore not reachable by unauthenticated or low-privileged users; impact is confined to low integrity (script execution in the browser context) with no confidentiality or availability effect per the vector; and because the product is a rolling release with no vendor response, exploitation applies to current unpatched checkouts around commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad.

This is a low-to-moderate real-world priority despite the medium CVSS 4.0 base score of 4.8. The strongest mitigating signal is the vector's PR:H: exploitation requires an attacker who already holds high privileges on the Administrative Console, and UI:P means a victim must perform some passive interaction for the payload to fire. Combined with VC:N/VI:L/VA:N (only low integrity impact, no confidentiality or availability loss), this describes a constrained admin-context cross-site scripting issue rather than a broadly dangerous remote flaw. Supporting signals: a public exploit exists (POC=YES) and the SSVC-style exploit maturity E:P (Proof-of-Concept) is consistent with that, but there is NO CISA KEV listing and no EPSS value was supplied, so there is no evidence of active or automatable exploitation. The AV:N network vector does not meaningfully elevate risk here because the PR:H privilege requirement gates access to the vulnerable Administrative Console function. In short: real but low-urgency - a genuine XSS with public POC, yet gated behind administrative privileges and limited to low integrity impact. Key missing data to note explicitly: no EPSS score was provided, so widespread-exploitation probability cannot be quantified; no fixed version exists because the project uses a rolling release; and the vendor has not responded to the report, so patch status is unconfirmed.

An attacker with high-privilege access to the Diem Administrative Console supplies a crafted value in the dm_command argument of the dmConsole append action, injecting script that executes in the browser of a console user who subsequently views the affected page. A public proof-of-concept exists (referenced in the project's GitHub issue #456), lowering the effort to reproduce. Because the console function requires high privileges and victim interaction, the realistic scenario is a malicious or compromised privileged user targeting other console operators rather than anonymous mass exploitation.