Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-19353— DedeCMS Installation Wizard index.php _4_Setup file inclusion

Quick assessment

Affected
n/a DedeCMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 DedeCMS（最高版本 5.7.118 UTF8SP2）中发现了一个漏洞。受影响的组件是安装向导（Installation Wizard）中的 文件里的 函数。该漏洞可导致文件包含问题。攻击者可以远程执行此攻击。该漏洞具有较高利用复杂度，利用难度较大。目前该漏洞已公开披露，并可能被恶意利用。

CVSS 5.0 · Medium EPSS 0.38% · P29

Affected Version Matrix 1

VendorProduct Version RangeStatus
n/a DedeCMS 5.7.118 UTF8SP2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-19353

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
DedeCMS Installation Wizard index.php _4_Setup file inclusion
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been found in DedeCMS up to 5.7.118 UTF8SP2. The affected element is the function _4_Setup of the file install/index.php of the component Installation Wizard. Such manipulation leads to file inclusion. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
文件名或路径的外部可控制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- DedeCMS 5.7.118 UTF8SP2 cpe:2.3:a:dedecms:dedecms:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-19353

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-19353

请登录查看更多情报信息。

News Coverage for CVE-2026-19353 (1)

Other References for CVE-2026-19353 (3)

IV. Related Vulnerabilities

Same product: DedeCMS
Same vendor: n/a
Same weakness: CWE-73

V. Comments for CVE-2026-19353

No comments yet

Leave a comment