DedeCMS CVE-2026-30643

DedeCMS is a PHP-based content management system. The vulnerability resides in the module upload feature, which processes setup tag values without adequate sanitization or validation. The root cause appears to be improper handling of user-supplied input in template or configuration tags that are passed to code execution routines during module installation or activation. This likely involves unsafe deserialization, direct code inclusion, or eval()-like constructs operating on untrusted setup tag parameters. The vulnerability affects the core module installation mechanism, which typically requires administrative or elevated permissions in most CMS architectures, though the description suggests this may be exploitable through unauthenticated upload channels.