What is the CVSS score of CVE-2026-38615?

CVE-2026-38615 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of DedeCMS are affected by CVE-2026-38615?

DedeCMS V5.7.118 contains a critical remote code execution vulnerability in its file-management endpoint that could enable complete website and infrastructure compromise if successfully exploited.

How to fix or mitigate CVE-2026-38615?

Within 24 hours: identify all DedeCMS V5.7.118 installations and restrict network access to file_manage_control.php to authorized administrators only via IP whitelisting; disable the endpoint entirely if file management is not required. Within 7 days: deploy Web Application Firewall rules to block suspicious requests to file_manage_control.php, enforce multi-factor authentication on all administrative accounts, and review administrative access logs for unauthorized activity. Within 30 days: upgrade to the latest available DedeCMS version with security patches (monitor DedeCMS official security advisories for release availability) or migrate to an actively maintained alternative CMS; invalidate all administrative session tokens and reset administrative credentials immediately after the upgrade.

DedeCMS CVE-2026-38615

CRITICAL

OS Command Injection (CWE-78)

2026-06-09 cve@mitre.org

Command Injection PHP

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

file_manage_control.php is an admin-backend script, so exploitation realistically requires an authenticated administrator (PR:H); network vector and total impact otherwise match, giving ~7.2.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:11 vuln.today

CVE Published

Jun 09, 2026 - 17:17 cve.org

CRITICAL 9.8

CVE Published

Jun 09, 2026 - 17:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

DedeCMS V5.7.118 is vulnerable to Command Execution in file_manage_control.php.

Articles & Coverage 1

News Critical Remote Code Execution in PHP - CVE-2026-38615 Jun 10, 2026

AnalysisAI

OS command execution in DedeCMS V5.7.118 via the file_manage_control.php file-management endpoint allows an attacker to run arbitrary system commands on the hosting web server, yielding total compromise of the site and underlying host. The flaw carries a CVSS 9.8 rating and publicly available exploit code exists (SSVC 'poc'), though EPSS estimates real-world exploitation probability at only 0.02% (5th percentile) and it is not listed in CISA KEV. Because file_manage_control.php is part of the DedeCMS admin backend, the practical attacker likely needs administrative access despite the CVSS PR:N claim - a discrepancy defenders should verify.

Technical ContextAI

DedeCMS (also known as DeDe/织梦) is a widely used PHP/MySQL content management system, and file_manage_control.php is a component of its administrative backend that handles server-side file operations (create, edit, upload, rename). The vulnerability is classified CWE-78 (Improper Neutralization of Special Elements used in an OS Command, i.e. OS Command Injection), meaning user-controllable input reaches a shell or system-execution primitive (such as PHP's system(), exec(), or shell_exec()) without adequate sanitization. Because DedeCMS is written in PHP and typically runs under a web server such as Apache or Nginx, injected commands execute with the privileges of the web-server process. No CPE strings were supplied in the intelligence, so the exact affected configuration matrix beyond the named version could not be enumerated.

Affected ProductsAI

The affected product is DedeCMS version 5.7.118 (the specific build named in the report); earlier or later builds were not confirmed as in-scope from the supplied data, and no CPE string was provided to bound the range precisely. No official vendor advisory URL was included in the references - the only pointers are a VulDB advisory entry at https://vuldb.com/vuln/369787 and a GitHub-hosted document at https://github.com/Bul11et/CMS/blob/main/1.docx (a .docx write-up rather than a formal patch or vendor bulletin).

RemediationAI

No vendor-released patch was identified at time of analysis, so no exact fixed version can be cited; monitor the official DedeCMS channels and the VulDB entry (https://vuldb.com/vuln/369787) for a corrected build and apply it once released. As specific compensating controls: restrict network access to the DedeCMS admin directory (typically /dede or a renamed admin path) to trusted management IPs via web-server allow-listing or a VPN, which blocks remote reach to file_manage_control.php at the cost of requiring admins to be on the management network; enforce strong, unique administrator credentials and multi-factor or IP-bound admin sessions to reduce the chance of an attacker reaching the backend; deploy a WAF rule to inspect and block command-injection metacharacters (backticks, ;, |, $(), &&) in requests to file_manage_control.php, accepting possible false positives on legitimate file operations; and run the PHP process under a least-privileged, non-root account with disable_functions covering system/exec/shell_exec/passthru where the application does not legitimately need them, noting this may break other plugins that rely on those functions.