Personal Management System EUVD-2026-112499

Exploitation requires an authenticated account on the Personal Management System instance (CVSS PR:H) with access to the storage module's file manager. The concrete prerequisites are: ability to create a directory under upload/files whose name contains shell metacharacters such as $(...), then invoke the storage tree 'move' or 'copy' operation, which passes the unescaped folder path into a shell command. Limiting factors: valid authentication is mandatory (no anonymous/pre-auth path), the attacker must reach the storage/file-manager feature, and the instance must be running a version through 2.1.0; no special non-default configuration is otherwise described. Resulting command execution is confined to the privileges of the web server user.

The signals point to a genuine but bounded risk rather than a drop-everything emergency. The CVSS 4.0 base score of 8.6 (High) reflects network reachability (AV:N), low attack complexity (AC:L), no attack requirements (AT:N), and full compromise of the vulnerable system's confidentiality, integrity and availability (VC:H/VI:H/VA:H) - consistent with OS command execution as the web server user. The critical tempering factor is PR:H: the vector explicitly requires high privileges, so this is an authenticated-only flaw, not a pre-auth internet-wide threat. The vuln.today decision label is 'this_week' (not act_now/emergency), aligning with a serious-but-not-frantic posture. KEV status is not listed (not confirmed actively exploited), and no EPSS score was supplied, so widespread automated exploitation probability cannot be quantified from the input - treat the absence of EPSS/KEV as missing data, not as evidence of safety. No verified working exploit code is indicated in the input, though VulnCheck published an advisory and the GitHub issue (#165) plus specific source-line references document the flaw precisely enough to accelerate exploit development. The product is a niche self-hosted open-source application, which further limits real-world blast radius. Net: a real, high-severity post-authentication RCE worth patching promptly for anyone running it, but its practical urgency is constrained by the authentication requirement and the product's small deployment footprint.

An authenticated user of a Personal Management System instance (versions through 2.1.0) uses the storage/file-manager module to create a directory under upload/files whose name contains shell metacharacters such as $(id). When the user then triggers a move or copy operation, the unescaped folder path is passed into the shell tree command and the embedded command executes as the web server user. No public working exploit is confirmed in the input, but the referenced source lines and VulnCheck advisory describe the mechanism in detail; low attack complexity (AC:L) means a logged-in attacker can trigger it reliably.