---
id: "CVE-2026-116063"
kind: "vulnerability"
aliases: ["CVE-2026-116063"]
title: "DedeCMS: vtime argument in update_guide.php allows remote code injection"
severity: "medium"
cvss: 5.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dedecms", "package", "php", "self-hosted"]
not_affected_if: ["admin-dir-blocked", "different-cms"]
published_at: "2026-10-25T18:16:47+00:00"
first_seen_at: "2026-10-25T19:05:28+00:00"
updated_at: "2026-10-25T19:06:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116063", "first_seen_at": "2026-10-25T19:05:28+00:00"}]
---

# DedeCMS: vtime argument in update_guide.php allows remote code injection

DedeCMS up to version 5.7.118 has a flaw in dede/update_guide.php where the vtime argument is passed into a require_once call without proper handling. A remote attacker can inject code through this argument, and a public exploit is reported to exist.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the DedeCMS version in the installation, and treat `5.7.118` and earlier as affected
- Look at `dede/update_guide.php` for use of the `vtime` parameter in `require_once`
- unknown whether the sources give a specific test command

## Fix

- unknown: the sources do not name a patched DedeCMS version
- Restrict or remove access to the `dede/` admin directory until a fix is confirmed

## Timeline

- 2026-10-25T19:05:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116063

## From the sources

A weakness has been identified in DedeCMS up to 5.7.118. Impacted is the function require_once of the file dede/update_guide.php. This manipulation of the argument vtime causes code injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_