What is the CVSS score of CVE-2026-29839?

CVE-2026-29839 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-29839?

Organizations using DedeCMS v5.7.118 face significant risk from CVE-2026-29839, a cross-site request forgery vulnerability rated CVSS 8.8.

How to fix or mitigate CVE-2026-29839?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

PHP CVE-2026-29839

EUVD-2026-14903 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-24 mitre

GHSA-rhgj-mg62-rmgh

PHP CSRF

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 24, 2026 - 16:00 euvd

EUVD-2026-14903

Analysis Generated

Mar 24, 2026 - 16:00 vuln.today

CVE Published

Mar 24, 2026 - 00:00 nvd

HIGH 8.8

DescriptionCVE.org

DedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in /sys_task_add.php.

AnalysisAI

DedeCMS v5.7.118 contains a Cross-Site Request Forgery (CSRF) vulnerability in the /sys_task_add.php endpoint that allows attackers to perform unauthorized actions on behalf of authenticated users without their knowledge or consent. An attacker can craft a malicious webpage or email that, when visited by an authenticated DedeCMS administrator, will execute unwanted administrative tasks such as adding or modifying system tasks. While no CVSS score, EPSS data, or active KEV listing is currently available, a public proof-of-concept exists on GitHub demonstrating the vulnerability's exploitability.

Technical ContextAI

The vulnerability resides in DedeCMS, a PHP-based content management system, specifically within the /sys_task_add.php file which handles the addition of system tasks. CSRF vulnerabilities occur when an application fails to properly validate that requests originate from legitimate users (typically through anti-CSRF tokens or same-site cookie attributes). This particular instance affects the task management functionality, which typically requires administrative privileges to access. The CWE classification would align with CWE-352 (Cross-Site Request Forgery), indicating missing or improperly implemented request validation mechanisms. The vulnerability likely stems from insufficient server-side validation to ensure that task addition requests come from authenticated sessions with proper origin verification.

RemediationAI

Immediately upgrade DedeCMS to a patched version released by the vendor after version 5.7.118 (consult https://www.dedecms.com/ for official security advisories and patch availability). If immediate patching is not feasible, implement the following interim controls: enforce HTTPS-only access with HSTS headers to prevent man-in-the-middle attacks, implement Content-Security-Policy headers to mitigate inline script execution, restrict administrative panel access to known IP ranges using firewall or web server rules, and ensure that all administrators use the same browser with protections against CSRF attacks (such as browser extensions that validate same-site cookie policies). Additionally, review web server logs and DedeCMS audit logs for unauthorized task creation attempts that may indicate exploitation.