CVE-2026-116063: DedeCMS update_guide.php require_once code injection
Published Oct 25, 2026
·Updated
A weakness has been identified in DedeCMS up to 5.7.118. Impacted is the function requireonce of the file dede/updateguide.php. This manipulation of the argument vtime causes code injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
Affected Software
1 affected component
DedeCMS Dedecms<=5.7.118
Event History
Oct 25, 2026
CVE Published
via MITRE·05:45 PM
Data Sourced
via MITRE·05:45 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
DedeCMS versions up to 5.7.118 are identified as affected. The vulnerable code is in dede/update_guide.php.
2
What access does an attacker need to exploit this issue?
The provided severity vector indicates that an attacker needs high privileges and does not require user interaction. Exploitation is described as remotely possible.
3
Is public exploit code available?
Yes. The available information states that an exploit has been made public and could be used in attacks.