CVE-2026-19353
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A vulnerability was found in DedeCMS up to version 5.7.118 UTF8SP2, leading to file inclusion in the _4_Setup function of the file install/index.php in the Installation Wizard component. The attack can be executed remotely but is characterized by high complexity and difficult exploitability. The exploit has been publicly disclosed.
Risk Assessment
File inclusion may allow an attacker to execute malicious code or read sensitive files, potentially leading to system security breaches. The high complexity of the attack reduces risk but does not eliminate it.
Recommendation
It is recommended to update DedeCMS to the latest version if available. Also secure the installer and restrict access to it after installation is complete.
Original NVD description (English source)
A vulnerability has been found in DedeCMS up to 5.7.118 UTF8SP2. The affected element is the function _4_Setup of the file install/index.php of the component Installation Wizard. Such manipulation leads to file inclusion. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used.