CVE-2026-116063

DedeCMS update_guide.php require_once code injection

A weakness has been identified in DedeCMS up to 5.7.118. Impacted is the function require_once of the file dede/update_guide.php. This manipulation of the argument vtime causes code injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

Affected

DedeCMS

CVSS v4.0 VULDB

2.0 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 VULDB

4.7 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CVSS v2.0 VULDB

5.8 MEDIUMAV:N/AC:L/Au:M/C:P/I:P/A:P

EPSS

0.25% chance of exploitation in the next 30 days, 17th percentile

Published

2026-10-25

Updated

2026-10-26

Proof-of-concept exploits (2)

• SDshadow/CVE-2026-116063Repo stars 0★ · pushed 2026-09-25 · find archive
  3 files

  DedeCMS/V5.7.118-update_guide-RCE/README.mdDedeCMS/V5.7.118-update_guide-RCE/poc/exploit.pyDedeCMS/V5.7.118-update_guide-RCE/poc/exploit.sh
• SDshadow/cve/tree/main/DedeCMS/V5.7.118-update_guide-RCE/pocRepo stars 0★ · pushed 2026-09-25 · snapshot
  2 files

  DedeCMS/V5.7.118-update_guide-RCE/poc/exploit.pyDedeCMS/V5.7.118-update_guide-RCE/poc/exploit.sh

CVE references

• SDshadow/cveREFERENCE
• https://vuldb.com/cve/CVE-2026-116063REFERENCE
• https://vuldb.com/submit/999433REFERENCE
• https://vuldb.com/vuln/426146REFERENCE
• https://vuldb.com/vuln/426146/ctiREFERENCE

References

• CVE Record
• NVD entry