Live › vulnerability › CVE-2026-116063
Go to dashboardDedeCMS up to version 5.7.118 has a flaw in dede/update_guide.php where the vtime argument is passed into a require_once call without proper handling. A remote attacker can inject code through this argument, and a public exploit is reported to exist.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 19:05 UTC. All times on this page are UTC.
Sites running DedeCMS up to 5.7.118 that expose the dede/update_guide.php file to requests. Sites where the admin directory is blocked from the internet or that run a different CMS are likely not exposed; the sources do not say more.
No product ranges from the sources yet.
5.7.118 and earlier as affecteddede/update_guide.php for use of the vtime parameter in require_oncedede/ admin directory until a fix is confirmedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in DedeCMS up to 5.7.118. Impacted is the function require_once of the file dede/update_guide.php. This manipulation of the argument vtime causes code injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-116063")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.