DedeCMS CVE-2026-116063

Requires authenticated high-privilege (administrator) access to the DedeCMS backend, as dede/update_guide.php is an admin-side install/update guide script and the CVSS vector specifies PR:H. The attacker then supplies a malicious vtime argument that reaches a require_once call, achieving PHP code injection remotely (AV:N, no user interaction). Limiting factors: exploitation is gated on valid admin authentication, so it is not reachable by anonymous remote users; accessibility of update_guide.php may also depend on the install/update directory being present and on versions at or below 5.7.118. The precise trigger mechanism beyond manipulation of vtime is not described in the available sources.

Signals are mixed and point to a moderate, authentication-gated risk rather than an urgent one. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, base 5.1 'medium') requires high privileges (PR:H), meaning an attacker must already hold DedeCMS administrator access - the affected file dede/update_guide.php sits in the product's admin backend. This is consistent with the vuln.today decision label 'this_month' (a routine-priority bucket, not act_now or emergency). No EPSS score is provided in the input, so the empirical exploitation-probability signal is missing and cannot be weighed. The vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation. A public PoC reference exists (github.com/SDshadow/cve), but the input flags it as 'reference only, not verified as working exploit code,' so it should not be treated as confirmed weaponized exploit code. Net: the code-injection flaw (CWE-94) is technically serious because it can yield server-side PHP execution, but the PR:H precondition confines it to already-privileged admins or post-compromise lateral use, which is why the vendor-side CVSS impacts are scored low and the overall priority is moderate rather than critical. Note the tension worth verifying: the Tags assert 'RCE' while the input CVSS 4.0 vector rates vulnerable-system impacts only Low (VC:L/VI:L/VA:L) - if this is genuine code execution the real impact is higher than the base vector suggests.

An attacker who already holds DedeCMS administrator access (or has hijacked an admin session) sends a crafted request to dede/update_guide.php with a malicious vtime argument that is fed into a require_once call, resulting in injection and execution of attacker-controlled PHP code on the server. A public PoC reference exists but is not verified as working exploit code. Because the CVSS vector specifies PR:H, valid high-privilege authentication is required, so realistic use is by malicious insiders or as a post-compromise escalation/persistence step rather than opportunistic unauthenticated attack.