CVE-2026-52102 Advisory

CVE-2026-52102.md

Security Advisory — CVE-2026-52102

CVE ID: CVE-2026-52102

Vendor: OpenMediaVault (Volker Theile)

Product / Component: OpenMediaVault — RAID management plugin (openmediavault-md)

Version(s) Affected: openmediavault-md 8.0.4-1 and previous versions.

CWE: CWE-78: Improper Neutralization of Special Elements Used in an OS Command (OS Command Injection)

Attack Vector: Remote

Privileges Required: authenticated administrator

Reporter(s): Gabriel Gomes, Rafael Romão

CVSS: 7.2

Vulnerability Description

An OS command injection vulnerability in the MdMgmt RPC service of the OpenMediaVault openmediavault-md plugin, affecting openmediavault-md 8.0.4-1 and previous versions, allows authenticated administrators to execute arbitrary commands as root on the underlying operating system. This issue is caused by improper sanitization of RAID parameters before they are passed to the OMV\System\Process helper, allowing direct injection of shell metacharacters into the executed command line.

Affected Components / Technical Details

• OpenMediaVault (https://www.openmediavault.org) — openmediavault-md 8.0.4-1 and previous versions.
• deb/openmediavault/usr/share/php/openmediavault/system/process.inc (lines 202-256) builds the command line with implode(" ", $cmdArgs) and executes it through PHP's exec() (line 251), which spawns /bin/sh -c. No quoting is applied to the individual elements of $cmdArgs, so any shell metacharacter contained in an element is interpreted by the shell instead of being treated as literal data.
• deb/openmediavault-md/usr/share/openmediavault/engined/rpc/mdmgmt.inc passes user-controlled RPC parameters into $cmdArgs unescaped:
  • the level parameter of the array creation method, forwarded to omv-mkraid;
  • the device lists of the creation, add and remove methods, which were concatenated with implode(" ", $devices) into a single argument and forwarded to mdadm --add, --fail and --remove.
• The OpenMediaVault backend (omv-engined) runs as root, so injected commands inherit that context.
• The insecure pattern resides in the general-purpose Process class; other consumers of this class should be reviewed for the same issue.

Impact

• An authenticated administrator can execute arbitrary commands as root on the OpenMediaVault host, resulting in full system compromise, including access to all stored data, persistence and pivoting into the internal network.
• The vulnerability is reachable via an HTTP POST request to /rpc.php carrying a valid administrative session cookie (OPENMEDIAVAULT-SESSIONID), and may therefore be chained with CSRF or XSS to achieve remote code execution without direct credential access.

Vendor Assessment

The vendor does not consider this issue critical, on the grounds that an attacker must already be authenticated as an administrator, and that such an attacker can achieve command execution more easily through the legitimate scheduled-jobs feature of the product. The fix was nevertheless applied and the reporters were credited in the commit message.

Mitigation

• Update to the openmediavault-md release containing commit f2d9ebe5521d7851f810ca6f049e6263f5db8aae, which applies escapeshellarg() to the level parameter and iterates the device arrays so that each device is escaped individually instead of being concatenated into a single argument.
• Restrict access to the web administration interface to trusted management networks and do not expose OpenMediaVault directly to the Internet.
• Limit the number of administrative accounts and enforce strong authentication.

References

• Vendor: https://www.openmediavault.org
• Fix commit: https://github.com/openmediavault/openmediavault/commit/f2d9ebe5521d7851f810ca6f049e6263f5db8aae
• CVE record: https://www.cve.org/CVERecord?id=CVE-2026-52102
• CWE-78: https://cwe.mitre.org/data/definitions/78.html