CVE-2026-15700
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A path traversal vulnerability has been discovered in DedeCMS 5.7.118 in the ExtractFile function of include/zip.class.php, used in the Album Publishing Feature. Manipulation of the filename argument allows remote exploitation.
Risk Assessment
An attacker can remotely read or overwrite arbitrary files on the server, potentially leading to data leakage, content modification, or full system compromise.
Recommendation
Immediately update DedeCMS to the latest available version that fixes this vulnerability, and restrict access to the Album Publishing Feature to trusted users only.
Other vulnerabilities in DedeCMS
See all- CVE-2017-17727High
DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/article_edit.php.
- CVE-2026-38615Critical
A command execution vulnerability in DedeCMS V5.7.118 in file_manage_control.php allows an attacker to execute arbitrary commands on the server.
- CVE-2023-34842Critical
Remote Code Execution vulnerability in DedeCMS through version 5.7.109 allows an attacker to execute arbitrary code via a crafted POST request to /dede/tpl.php.
- CVE-2023-37839Critical
DedeCMS v5.7.109 has an arbitrary file upload vulnerability in /dede/file_manage_control.php that allows attackers to execute arbitrary code by uploading a crafted PHP file.
- CVE-2017-17731Critical
DedeCMS through 5.7 is vulnerable to SQL Injection via the $_FILES superglobal in plus/recommend.php.
- CVE-2017-17730Critical
DedeCMS versions up to 5.7 are vulnerable to SQL Injection via the logo parameter in plus/flink_add.php.
- CVE-2026-76800Medium
A flaw has been found in DeDeCMS 3. Affected by this vulnerability is an unknown functionality of the file /include/dialog/select_media_post.php. Executing a manipulation of the argument uploadfile can lead to unrestricted upload. The attack can be executed remotely. The exploit has been published and may be used.
- CVE-2026-76783High
A security vulnerability has been detected in DeDeCMS 53_1_UTF8. This vulnerability affects unknown code of the file /plus/advancedsearch.php. Such manipulation of the argument sql leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
- CVE-2026-19353Medium
A vulnerability was found in DedeCMS up to version 5.7.118 UTF8SP2, leading to file inclusion in the _4_Setup function of the file install/index.php in the Installation Wizard component. The attack can be executed remotely but is characterized by high complexity and difficult exploitability. The exploit has been publicly disclosed.
- CVE-2026-15533Medium
A security flaw was discovered in DedeCMS 5.7.118 in the file /plus/search.php within the Column Management component. Manipulating the Column Name argument allows remote code injection. The exploit has been publicly released and may be used in attacks.
Original NVD description (English source)
A security flaw has been discovered in DedeCMS 5.7.118. Affected by this vulnerability is the function ExtractFile of the file include/zip.class.php of the component Album Publishing Feature. The manipulation of the argument filename results in path traversal. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.