Is there a public PoC exploit available for CVE-2026-15700?

Yes, a public proof-of-concept exploit is available for CVE-2026-15700. Prioritise patching immediately. EPSS: 0.4%.

DedeCMS CVE-2026-15700

Q: What is the CVSS score of CVE-2026-15700?

CVE-2026-15700 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-43731 LOW

Path Traversal (CWE-22)

2026-07-14 VulDB

GHSA-wg6f-4fm3-8f78

PHP Path Traversal Dedecms N A

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.8 LOW

Admin-level authentication required (PR:H); path traversal yields partial file read/write (C:L/I:L) with no scope change or availability impact confirmed.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 14, 2026 - 17:22 NVD

MEDIUM LOW

CVSS changed

Jul 14, 2026 - 17:22 NVD

5.1 (MEDIUM) 2.0 (LOW)

Analysis Generated

Jul 14, 2026 - 17:01 vuln.today

CVE Published

Jul 14, 2026 - 16:15 cve.org

MEDIUM 5.1

DescriptionCVE.org

A security flaw has been discovered in DedeCMS 5.7.118. Affected by this vulnerability is the function ExtractFile of the file include/zip.class.php of the component Album Publishing Feature. The manipulation of the argument filename results in path traversal. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Path traversal in DedeCMS 5.7.118's Album Publishing Feature allows remote attackers with administrative credentials to read or write files outside the intended extraction directory by manipulating the filename argument passed to the ExtractFile function in include/zip.class.php. A public proof-of-concept exploit has been released on GitHub, lowering the skill bar for exploitation, though no active exploitation has been confirmed in the CISA KEV catalog. The CVSS 4.0 score of 5.1 with PR:H reflects the high privilege requirement, which materially limits the exposed attack surface to authenticated admin-level sessions.

Technical ContextAI

DedeCMS (织梦CMS) is a PHP-based content management system widely used in Chinese-language web markets. The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), meaning the ExtractFile function in include/zip.class.php fails to sanitize or canonicalize the filename argument prior to performing filesystem operations during archive extraction in the Album Publishing Feature. An attacker can supply path traversal sequences such as ../../ within the filename to escape the intended extraction directory and read or write arbitrary files accessible to the web server process. The CPE string cpe:2.3:a:n/a:dedecms:*:*:*:*:*:*:*:* uses a wildcard version field, indicating NVD has not constrained the version range beyond the specific version (5.7.118) named in the vulnerability report.

RemediationAI

No vendor-released patch has been identified at the time of analysis - patch availability is unconfirmed, and no official vendor advisory URL was found among the provided references. As a primary compensating control, restrict access to the Album Publishing Feature exclusively to trusted administrative accounts and audit existing role assignments to revoke unnecessary elevated privileges, directly countering the PR:H exploitation prerequisite. Implement server-side input validation on the filename parameter within include/zip.class.php to reject or strip path traversal sequences before any filesystem operation is performed - this is the targeted fix location. Deploy a Web Application Firewall rule to block requests containing unencoded or URL-encoded traversal patterns (../, %2e%2e%2f) targeting the archive extraction endpoint; note that WAF rules may produce false positives on legitimate filenames with dots. Network-isolate the DedeCMS administrative backend from untrusted networks as an additional boundary control. Monitor VulDB at https://vuldb.com/vuln/378247 and the public exploit repository at https://github.com/DunkBoyZz/dedecms/tree/379d9ec42cbe5d5b177578218070d69b6dada83f/2 for vendor patch announcements.