EUVD-2026-17960
GHSA-vc3q-w6jg-xcpj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
An issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup tag values in a module upload.
AnalysisAI
Remote code execution in DedeCMS 5.7.118 allows unauthenticated attackers to execute arbitrary code through crafted setup tag values during module upload operations. The vulnerability exploits insufficient input validation in the module upload functionality, enabling direct code injection. No CVSS score, EPSS data, or KEV confirmation is available; however, the presence of a public proof-of-concept demonstrates practical exploitability.
Technical ContextAI
DedeCMS is a PHP-based content management system. The vulnerability resides in the module upload feature, which processes setup tag values without adequate sanitization or validation. The root cause appears to be improper handling of user-supplied input in template or configuration tags that are passed to code execution routines during module installation or activation. This likely involves unsafe deserialization, direct code inclusion, or eval()-like constructs operating on untrusted setup tag parameters. The vulnerability affects the core module installation mechanism, which typically requires administrative or elevated permissions in most CMS architectures, though the description suggests this may be exploitable through unauthenticated upload channels.
RemediationAI
Upgrade DedeCMS to a patched version released after 5.7.118. Consult the official DedeCMS website (https://www.dedecms.com/) for the latest stable release and installation instructions. As an interim measure, restrict access to the module upload functionality to trusted administrators only, disable the module upload feature entirely if not in active use, and implement strict input validation and Web Application Firewall (WAF) rules to block requests with suspicious setup tag syntax or encoded payloads targeting the upload endpoints. Additionally, audit all currently installed modules for unauthorized or malicious code, and review server logs for evidence of prior exploitation attempts.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today