CVE-2026-19353: DedeCMS Installation Wizard index.php _4_Setup file inclusion
A vulnerability has been found in DedeCMS up to 5.7.118 UTF8SP2. The affected element is the function 4Setup of the file install/index.php of the component Installation Wizard. Such manipulation leads to file inclusion. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19353?
The severity of CVE-2026-19353 is classified as medium with a score of 5.
How do I fix CVE-2026-19353?
To fix CVE-2026-19353, update DedeCMS to the latest version that addresses this file inclusion vulnerability.
What type of attack does CVE-2026-19353 allow?
CVE-2026-19353 allows for remote file inclusion attacks that can lead to unauthorized access to server files.
Which versions of DedeCMS are affected by CVE-2026-19353?
CVE-2026-19353 affects DedeCMS versions up to 5.7.118 UTF8SP2.
What is the potential impact of CVE-2026-19353?
The potential impact of CVE-2026-19353 includes unauthorized access to sensitive files and system compromise.