PT-2026-50664 · Lms · Lms

Tymoteusz Dominik · Published 2026-06-18 · Updated 2026-06-18 · CVE-2026-40456

NVD

CVSS v4.0

8.6

High

Base vector

AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

An OS Command Injection vulnerability exists in LMS (LAN Management System) before commit 9fcb4de due to an IP address parameter being passed to the "exec()" function without proper validation, allowing attackers to execute arbitrary operating system commands.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-40456

Affected Products

Lms

References · 4

• https://github.com/chilek/lms/commit/9fcb4de19b7d76394898dbc124252b86b07ac0ed · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40456 · Security Note
• https://lms.org.pl · Note
• https://cert.pl/posts/2026/06/CVE-2026-40455 · Note