CVE-2026-116063
DedeCMS update_guide.php require_once code injection
- State
- Published
- Severity
- 5.1 Medium
- Published
- Oct 25, 2026
- Updated
- Oct 26, 2026
- Reserved
- Oct 24, 2026
Description
A weakness has been identified in DedeCMS up to 5.7.118. Impacted is the function require_once of the file dede/update_guide.php. This manipulation of the argument vtime causes code injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.7 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 3.0 | 4.7 Medium | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 2.0 | 5.8 Medium | AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
DedeCMSn/a |
|
References
- VDB-426146 | DedeCMS update_guide.php require_once code injectionvdb-entrytechnical-description
- VDB-426146 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-116063 | CVE Analysis and Reportthird-party-advisory
- Submit #999433 | DedeCMS 5.7.118 Code Injectionthird-party-advisory
- https://github.com/SDshadow/cverelated
- https://github.com/SDshadow/cve/tree/main/DedeCMS/V5.7.118-update_guide-RCE/pocexploitpatch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.