{"id":"CVE-2026-116063","kind":"vulnerability","aliases":["CVE-2026-116063"],"related":[],"title":"DedeCMS: vtime argument in update_guide.php allows remote code injection","description":"A weakness has been identified in DedeCMS up to 5.7.118. Impacted is the function require_once of the file dede/update_guide.php. This manipulation of the argument vtime causes code injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.","summary":"DedeCMS up to version 5.7.118 has a flaw in dede/update_guide.php where the vtime argument is passed into a require_once call without proper handling. A remote attacker can inject code through this argument, and a public exploit is reported to exist.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dedecms","package","php","self-hosted"],"not_affected_if":["admin-dir-blocked","different-cms"],"how_to_check":"- Check the DedeCMS version in the installation, and treat `5.7.118` and earlier as affected\n- Look at `dede/update_guide.php` for use of the `vtime` parameter in `require_once`\n- unknown whether the sources give a specific test command","fix":"- unknown: the sources do not name a patched DedeCMS version\n- Restrict or remove access to the `dede/` admin directory until a fix is confirmed","status":"open","published_at":"2026-10-25T18:16:47+00:00","first_seen_at":"2026-10-25T19:05:28+00:00","triaged_at":"2026-10-25T19:06:50+00:00","updated_at":"2026-10-25T19:06:50+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T19:06:50Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a patched DedeCMS version\n- Restrict or remove access to the `dede/` admin directory until a fix is confirmed","reach":"internet","title":"DedeCMS: vtime argument in update_guide.php allows remote code injection","impact":"high","summary":"DedeCMS up to version 5.7.118 has a flaw in dede/update_guide.php where the vtime argument is passed into a require_once call without proper handling. A remote attacker can inject code through this argument, and a public exploit is reported to exist.","category":"package","nicknames":[],"who_cares":["dedecms","php","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker runs injected code on the web server","analyst_note":"Check the NVD entry and any vendor or DedeCMS release notes for a fixed version and whether authentication is required to reach update_guide.php.","how_to_check":"- Check the DedeCMS version in the installation, and treat `5.7.118` and earlier as affected\n- Look at `dede/update_guide.php` for use of the `vtime` parameter in `require_once`\n- unknown whether the sources give a specific test command","needs_analyst":true,"not_affected_if":["admin-dir-blocked","different-cms"],"who_is_affected":"Sites running DedeCMS up to 5.7.118 that expose the dede/update_guide.php file to requests. Sites where the admin directory is blocked from the internet or that run a different CMS are likely not exposed; the sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000615,"input_tokens":3303,"output_tokens":569,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116063':12A,15A '-2026':11A,14A '5.7.118':26B,72C 'allow':6A 'argument':3A,35B,54B,87C 'attack':48B,96C,113C 'avail':104C 'call':42B 'caus':89C 'code':8A,51B,90C 'could':109C 'cve':10A,13A 'dede/update_guide.php':31B,82C 'dedecm':1A,16B,22B,69C 'exist':62B 'exploit':58B,93C,100C 'file':81C 'flaw':29B 'function':76C 'handl':45B 'host':21B 'identifi':67C 'impact':73C 'inject':9A,50B,91C 'made':103C 'manipul':84C 'packag':17B 'pass':37B 'php':18B 'possibl':98C 'proper':44B 'public':57B,107C 'remot':7A,47B,92C 'report':60B 'requir':40B,77C 'self':20B 'self-host':19B 'update_guide.php':5A 'use':111C 'version':25B 'vtime':2A,34B,88C 'weak':64C 'without':43B","nicknames":[],"mitigations":[],"who_affected":"Sites running DedeCMS up to 5.7.118 that expose the dede/update_guide.php file to requests. Sites where the admin directory is blocked from the internet or that run a different CMS are likely not exposed; the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T18:16:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116063","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116063","severity":null,"published_at":"2026-10-25T18:16:47+00:00","modified_at":"2026-10-25T18:16:47+00:00","first_seen_at":"2026-10-25T19:05:28+00:00","fetched_at":"2026-10-25T19:05:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}