DedeCMS Installation Wizard index.php _4_Setup file inclusion

published 2026-08-09 3 mo ago modified 2026-08-12 2 mo ago also EUVD-2026-54921

cvss: 5.0; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 32%
public exploits: 0; none known

A vulnerability has been found in DedeCMS up to 5.7.118 UTF8SP2. The affected element is the function _4_Setup of the file install/index.php of the component Installation Wizard. Such manipulation leads to file inclusion. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used.

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 2 mo ago (2026-08-11)

Exploit prediction

0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/I4m6da/CVE/issues/9 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	2.3	CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CNA	3.1	5.0	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CNA	3.0	5.0	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CNA	2.0	4.6	AV:N/AC:H/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
CNA	4.0	1.3	CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	5.0	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
CNA	2.0	4.6	AV:N/AC:H/Au:S/C:P/I:P/A:P

Affected products

n/a DedeCMS

Classification

Weakness

CWE-73 External Control of File Name or Path

References

github.com /I4m6da/CVE/issues/9
exploit, issue-tracking
vuldb.com /vuln/387207
vdb-entry, technical-description
vuldb.com /vuln/387207/cti
signature, permissions-required
vuldb.com /cve/CVE-2026-19353
third-party-advisory
vuldb.com /submit/865977
third-party-advisory

Sources

CVE List CVE-2026-19353
NVD CVE-2026-19353

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary