PT-2026-69294

CVE-2026-19353

Published

2026-06-01

Updated

2026-08-11

Description by

CVSS 3.1

5.0

Medium

MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions DedeCMS versions prior to 5.7.119 UTF8SP2

Description A file inclusion issue exists within the Installation Wizard component. The flaw is located in the 4 Setup() function of the install/index.php file. This allows a remote attacker to include files through a high-complexity attack that is difficult to execute.

Recommendations Update DedeCMS to a version newer than 5.7.118 UTF8SP2. As a temporary mitigation, restrict access to the install/index.php file or disable the Installation Wizard component.

Exploitability

Exploit

Fix

Impacts

Researchers

I4M6Da

Vendors

Affected products

Weakness enumeration

CWE-73: External Control of File Name or Path

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers