Diem EUVD-2026-104246

Exploitation requires an authenticated account with HIGH privileges (CVSS PR:H) that already has access to the Diem backend dmCodeEditor component, and specifically the ability to invoke the dmOs::join function in dmFrontPlugin/modules/dmCodeEditor/actions/actions.class.php with attacker-controlled path input. This is a backend/administrative code-editor feature, so the vulnerability is NOT reachable by anonymous or low-privilege users; the HIGH-privilege prerequisite is the primary limiting factor. No special non-default configuration is indicated beyond the dmCodeEditor component being present and accessible, and no user interaction by a victim is required (UI:N).

This is a medium-severity issue (CVSS 4.0 base 5.1) whose real-world priority is low despite the public exploit. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L) shows network reach with low complexity but requires HIGH privileges (PR:H) and yields only LOW confidentiality, integrity, and availability impact. The E:P (Proof-of-Concept) exploit maturity aligns with the 'POC publicly available' signal, but there is no CISA KEV listing and no EPSS score in the provided data, so there is NO evidence of active or widespread exploitation. The attacker must already be an authenticated high-privilege user with access to the dmCodeEditor backend component - a path traversal from that position is a marginal privilege/scope gain, not a remote-unauthenticated compromise. Signals are internally consistent (PR:H matches an admin-only code-editor feature), so this reads as a genuine-but-low-priority finding rather than a high-impact one. Note: EPSS probability is MISSING and cannot be used to gauge exploitation likelihood; the data originates solely from VulDB and the vendor has not responded or issued a patch.

An attacker who already holds a high-privilege account with access to the Diem backend dmCodeEditor module invokes the dmOs::join function with a crafted path containing traversal sequences (e.g. ../../), causing the editor to read or write files outside its intended directory. A proof-of-concept is publicly available via the project's GitHub issue tracker, so the technique is reproducible, though exploitation is gated behind prior authenticated high-privilege access.