DedeCMS CVE-2026-19353

The Installation Wizard (install/index.php) must remain accessible on the target server - in properly hardened DedeCMS deployments this directory is removed post-installation, which alone eliminates the attack surface. The CVSS 4.0 vector specifies PR:L, meaning the attacker must possess some level of authenticated or low-privilege access to the system; unauthenticated exploitation against default-locked installations is not supported by the available data. Attack complexity is rated High (AC:H), and the description explicitly characterizes exploitability as 'difficult', implying specific environmental or timing conditions must align. Exploitation is limited to DedeCMS 5.7.118 UTF8SP2 and earlier; later versions, if any exist, are not confirmed affected. Impact is bounded to Low across all CIA dimensions, limiting the practical value of successful exploitation.

The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) and corresponding score of 1.3 place this at the extreme low end of the severity scale. Attack complexity is rated High, reflecting that exploitation is described as 'difficult' and requires specific conditions to be met. Low privileges are required (PR:L), meaning the attacker cannot exploit this unauthenticated against default installations. Impact across confidentiality, integrity, and availability is uniformly Low, with no subsequent-system scope change. No EPSS data was provided in the intelligence feed. The vulnerability is not listed in CISA KEV, indicating no confirmed widespread active exploitation. The publicly available POC on GitHub (github.com/I4m6da/CVE/issues/9) is a meaningful signal but, combined with the high attack complexity and limited impact, does not elevate real-world priority significantly. For most organizations, this is a low-urgency finding unless DedeCMS is actively deployed with the install directory left accessible post-installation.

An attacker with low-level authenticated access to a DedeCMS instance where the install/ directory remains accessible crafts a request to install/index.php targeting the _4_Setup function, manipulating a file path parameter to reference a server-side file outside the intended scope. If exploitation conditions are met, the attacker can read restricted file contents or, depending on included file content, potentially influence application behavior. A public POC demonstrating this technique exists at github.com/I4m6da/CVE/issues/9.