CVE-2026-19353
Received Received - Intake

File Inclusion in DedeCMS Installation Wizard

Publication date: 2026-08-09

Last updated on: 2026-08-09

Assigner: VulDB

Description
A vulnerability has been found in DedeCMS up to 5.7.118 UTF8SP2. The affected element is the function _4_Setup of the file install/index.php of the component Installation Wizard. Such manipulation leads to file inclusion. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-09
Last Modified
2026-08-09
Generated
2026-08-09
AI Q&A
2026-08-09
EPSS Evaluated
N/A
NVD
CVE-2026-19353
EUVD
EUVD-2026-54921

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dede dedecms to 5.7.118 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a file inclusion flaw in DedeCMS versions up to 5.7.118. It exists in the installation process, specifically in the _4_Setup function of install/index.php. Attackers can remotely include malicious files by manipulating POST parameters, leading to potential remote code execution. The attack requires high complexity and is difficult to exploit but has been publicly disclosed.

Detection Guidance

Check for the presence of the installation directory and files like install/index.php or install/install_lock.txt. Look for unexpected PHP files in the DedeCMS directory, especially modules.tmp.inc. Monitor network traffic for unauthenticated POST requests to install/index.php with parameters like step=4 or step=10.

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary PHP code on your server. This could lead to full system compromise, data theft, or unauthorized access. The impact depends on server configuration but may include complete control over the affected website and its databases.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Delete the installation directory or restrict access to it. Remove install/install_lock.txt if present. Update DedeCMS to the latest version. Implement input validation for module parameters and rate-limit database connectivity test endpoints. Block external access to the installation directory in production.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19353. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart