Volmarg Personal Management System: OS command injection in storage module

Summary

Volmarg Personal Management System up to and including version 2.1.0 contains an OS command injection flaw in the storage module's tree command. Unescaped folder paths are passed to the shell, so an authenticated user can create a directory with shell metacharacters such as $(...) under upload/files and then move or copy it to run commands. Commands run with the privileges of the web server user, which gives access to application data and possibly the host.

Affected

• Volmarg personal-management-system, versions 0 to 2.1.0 (per CVE record)
• Version 2.0 is also listed by VulDB
• Affected version and commit details are not fully confirmed across sources

Fixed in

Unknown. No fixed version or vendor advisory was found at the time of writing.

Workaround

• No vendor workaround is available.
• Remove internet exposure; place the application behind a VPN or an authenticated reverse proxy.
• Restrict or remove unneeded user accounts.
• Run the web server/PHP process as a dedicated low-privilege user without write access outside the application directories.
• Disable access to the storage module if it is not needed.
• Review the upload/files tree for directory names containing shell metacharacters.

Exploitation

• Not known to be exploited in the wild.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public exploit in Metasploit or Exploit-DB and no public Nuclei template were found.
• The reporter's GitHub issue describes the flaw and a demonstrated reverse shell; this was not verified.
• Requires an authenticated account.

Our recommendation

• Check whether the application is internet-reachable or has many user accounts; if so, treat as high priority.
• Remove internet exposure and restrict access to trusted users via VPN or reverse proxy.
• Review user accounts and remove unused ones.
• Run the application with a low-privilege service account.
• Monitor the upload/files directory for suspicious folder names.
• Ask Volmarg for a fix timeline and check the repository regularly for a patched release.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record / VulnCheck advisory www.vulncheck.com
• GitHub issue #165 github.com
• Vendor repository github.com
• ShellAbstractService.php at v2.1.0 github.com
• ShellTreeService.php at v2.1.0 github.com
• VulDB CVE-2026-118755 vuldb.com
• VulDB vulnerability 428236 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:51.